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LETTER OF SUBMITTAL 


U.S. HOUSE or REPRESENTATIVES, 
Washington, DC, October 29, 1986. 
Hon. Tuomas P. О’МЕпл, Jr., 
The Speaker of the U.S. House of Representatives, Washington, DC. 

DEAR МЕ. SPEAKER: 

By direction of the Committee on Science and Technology, I 
hereby submit the Committee’s investigative report on the Chal- 
lenger accident. The report was approved by the Committee on Oc- 
tober 7, 1986. The report was carried out under the direction of the 
Ranking Majority Member, Robert A. Roe, who chaired the hear- 
ings and instructed the Committee staff assigned to the investiga- 
tion. 

Sincerely, 
Don Fuqua, Chairman. 

Enclosure. 
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LETTER OF TRANSMITTAL 


U.S. House or REPRESENTATIVES, 
COMMITTEE ON SCIENCE AND TECHNOLOGY, 
Washington, DC, October 29, 1986. 
To Robert A. Roe, Ranking Majority Member, Committee on Science 
and Technology. 

DEAR Mr. CHAIRMAN: 

I am forwarding this investigative report on the Challenger Acci- 
dent prepared at your request. 

On your instructions, the staff has carefully reviewed the infor- 
mation made available to the Committee and prepared the neces- 
sary findings and recommendations. The task was enormous and 
has been done in a careful and painstaking manner. I am especial- 
ly grateful to all the staff which is listed on the inside cover of the 
report for their professional and thorough application to this im- 
portant report. We worked in a collegial manner and on a com- 
pletely bipartisan basis. I particularly want to thank the three 
group leaders, Ron Williams, Terry Dawson and Harriet Smith 
who headed up the respective subgroups for the Accident, the Tech- 
nical, and the Management Issues. 

Sincerely, 
Вовевт С. КЕТСНАМ, General Counsel. 
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INVESTIGATION OF THE CHALLENGER ACCIDENT 


OCTOBER 29, 1986.—Committed to the Committee ої the Whole House on the State of 
the Union and ordered to be printed 


Mr. Fuqua, from the Committee on Science and Technology, 
submitted the following 


REPORT 


І. INTRODUCTION 


On January 28, at 11:39 a.m., the Space Shuttle Challenger and 
its crew suffered a tragic accident during launch. That same day 
the House of Representatives adopted Н. Res. 861 which expressed 
the profound sorrow of the House for the tragedy and offered con- 
dolences to the families of the Challenger crew members. 

During consideration of the resolution Chairman Fuqua informed 
the full House of Representatives that, in conformance with its 
oversight responsibilities, the Committee on Science and Technolo- 
gy would conduct a comprehensive investigation into the cause of 
this accident. 

This report is the result of the Committee’s inquiry. It contains 
the best efforts of the Committee to review the work of the Presi- 
dential Commission on the Space Shuttle Challenger Accident 
(hereafter referred to as the Rogers Commission) and the work of 
the National Aeronautics and Space Administration (NASA) іп іп- 
vestigating the causes of the accident, and reviewing the recom- 
mendations to resume safe flight. 

In addition to reviewing the five volumes of the Rogers Commis- 
sion Report, the Committee also had direct on-line access to the 
entire Rogers Commission data base, which included full-text and 
document retrieval capability. 

The findings and recommendations contained in this report are 
the product of the Committee’s own extensive hearing record, 


! Report of the Presidential Commission on the Space Shuttle Challenger Accident, Volumes [- 
V, Washington, D.C., June 6, 1986. (Hereafter referred to as Rogers Commission Report.) 
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which includes materials submitted for the record, staff investiga- 
tions, interviews, and trips. 

It should be understood that the role of this Committee is differ- 
ent from that of the four-month Rogers Commission. The Commit- 
tee, which authorized the funds and reviewed the lengthy develop- 
ment process which led to the successful Shuttle program, has a re- 
sponsibility to insure that the tragic accident, and those events 
that led up to it, are understood and assimilated into all levels and 
activities of NASA so that safe manned space flight can be re- 
sumed. 

In carrying out its annual authorizing responsibilities, the Com- 
mittee endorses the programs and activities of NASA, and func- 
tions as a key player in the legislative activities of our federal 
system. As part of the fulfillment of this role, the Committee has 
reviewed the report of the Rogers Commission, called upon numer- 
ous witnesses, and utilized many members of its staff to prepare 
and review the material that has produced this report. 

The Committee has been most fortunate in its work due to the 
diligent and thorough investigation undertaken by the Rogers Com- 
mission and the NASA investigation panels that supported the 
Commission. The Commission’s exhaustive efforts to achieve com- 
pleteness as it came to grips with a very complex technical and 
management system are very commendable, and will serve as a 
model for future Presidential Commissions. | 

The Committee wishes to express its appreciation for the assist- 
ance of the House Administration Committee, the Rogers Commis- 
sion staff, and the Justice Department’s Office of Litigation Sup- 
port, Civil Division. Each of these groups was very cooperative and 
helpful in providing the access to, and equipment for, the Challeng- 
er accident data base needed by the Committee to do its work. In 
addition, the Committee very much appreciates the assistance of 
NASA personnel who responded to numerous requests for briefings 
and documents during the course of the investigation. 


П. CONCLUSIONS 


In execution of its oversight responsibilities, the Committee on 
Science and Technology has conducted a thorough investigation of 
the Challenger accident. Although the Committee’s concern and 
evaluation in this report are related specifically to the safe and ef- 
fective functioning of NASA's Space Shuttle program, it should be 
understood that our larger objective and greater responsibility are 
to insure that NASA, as the Nation's civilian space agency, main- 
tains organizational and programmatic excellence across the board. 

What we as a Committee, NASA as an agency, and the Nation as 
a whole, also must realize is that the lessons learned by the Chal- 
lenger accident are universally applicable, not just for NASA but 
for governments, and for society. We hope that this report will 
serve this much larger purpose. 

The Committee's investigation included: ten formal hearings in- 
volving 60 witnesses; an extensive review of the report of the 
Rogers Commission along with its voluminous supporting appendi- 
ces and related reports by the investigation panels at NASA, as 
well as numerous briefings and interviews with NASA officials, 
contractor personnel, outside experts, and other interested parties. 

From the outset, the focus of the Committee's investigation has 
been on understanding each of the following: 


What was the cause, or causes, of the Challenger acci- 
епі! 

Are there other inherent hardware ог management-re- 
lated deficiencies that could cause additional accidents in 
the future? 

What must be done to correct all of these problems so 
that the Space Shuttle can be safely returned to flight 
status’ 


The Committee found that NASA’s drive to achieve a launch 
schedule of 24 flights per year created pressure throughout the 
agency that directly contributed to unsafe launch operations. The 
Committee believes that the pressure to push for an unrealistic 
number of flights continues to exist in some sectors of NASA and 
jeopardizes the promotion of a “safety first" attitude throughout 
the Shuttle program. 

The Committee, the Congress, and the Administration have 
played a contributing role in creating this pressure. Congressional 
and Administration policy and posture indicated that a reliable 
flight schedule with internationally competitive flight costs was a 
near-term objective. 

Pressures within NASA to attempt to evolve from an R&D 
agency into a quasicompetitive business operation caused a realign- 
ment of priorities in the direction of productivity at the cost of 
safety. 
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NASA management and the Congress must remember the les- 
sons learned from the Challenger accident and never again set un- 
reasonable goals which stress the system beyond its safe function- 
ing. 

The Committee commends the work of the Rogers Commission 
and its supporting panels at NASA. Their investigation and the re- 
ports that document their efforts are very broad in scope and ex- 
ceptionally detailed considering the time that was available to ac- 
complish their task. 

As a rule, the Committee agrees with the findings reached by the 
Rogers Commission. However, there are areas where the Commit- 
tee either disagrees with a Rogers Commission finding or with the 
relative importance that the Rogers Commission attached to that 
finding. 

Like the Rogers Commission, the Committee concluded that the 
Challenger accident was caused by a failure in the aft field joint on 
the right-hand Solid Rocket Motor. Additionally, we agree with the 
Rogers Commission that this tragic accident was not caused by the 
Orbiter, the Space Shuttle Main Engines, the External Tank, the 
onboard payloads, the ground support equipment, or the other ele- 
ments of the Solid Rocket Boosters. We also agree that the failure 
of the joint was due to a faulty design, and that neither NASA nor 
Thiokol fully understood the operation of the joint prior to the acci- 
dent. Further, the joint test and certification programs were inad- 
equate, and neither NASA nor Thiokol responded adequately to 
available warning signs that the joint design was defective. 

In concurrence with the Rogers Commission, the Committee con- 
firms that the safety, reliability, and quality assurance programs 
within NASA were grossly inadequate, but in addition recommends 
that NASA review its risk management activities to define a com- 
plete risk management program. The Committee also agrees that a 
thorough review must be conducted on all Criticality 1 and 1R 
items and hazard analyses; a study should be conducted on how to 
provide Space Shuttle crews with a means of escape during con- 
trolled gliding flight; and NASA’s Shuttle management structure, 
safety organization, communications procedures, and maintenance 
policies should be carefully scrutinized and improved. 

In other areas, the Committee reached somewhat different con- 
clusions than the Rogers Commission: 


The Rogers Commission concluded that NASA’s decision- 
making process was flawed. The Committee does agree 
that the Marshall Space Flight Center should have passed 
along to higher management levels the temperature con- 
cerns that Thiokol engineers raised the night before the 
launch of Mission 51-L. However, the Committee feels that 
the underlying problem which led to the Challenger acci- 
dent was not poor communication or inadequate proce- 
dures as implied by the Rogers Commission conclusion.! 
Rather, the fundamental problem was poor technical deci- 
sion-making over a period of several years by top NASA 


1 For the purpose of this report, a procedure is а formal set of instructions designed to guide 
and assist in the performance of a technical or management function. 
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and contractor personnel, who failed to act decisively to 
solve the increasingly serious anomalies in the Solid 
Rocket Booster joints. 

Information on the flaws in the joint design and on the 
problems encountered in missions prior to 51-L was widely 
available and had been presented to all levels of Shuttle 
management. Despite the presence of significant amounts 
of information and the occurrence of at least one detailed 
briefing at Headquarters on the difficulties with the O- 
rings, the NASA and Thiokol technical managers failed to 
understand or fully accept the seriousness of the problem. 
There was no sense of urgency on their part to correct the 
design flaws in the SRB. No one suggested grounding the 
fleet, nor did NASA embark on a concerted effort to 
remedy the deficiencies in O-ring performance. Rather, 
NASA chose to continue to fly with a flawed design and to 
follow a measured, 27-month, corrective program. 

The Committee has more concerns than those expressed 
by the Rogers Commission about the relative safety of the 
Space Shuttle Main Engine. We are impressed by the so- 
phistication and performance of the Main Engine, but are 
concerned that it may have inadequate safety margins to 
ensure continued safe operation. The Committee is also 
concerned by the presence of persistent operating prob- 
lems with the engine (e.g., cracked turbine blades and de- 
fective hydraulic actuators and temperature sensors), and 
believes that NASA should give serious consideration to 
not allowing the Main Engine to be operated (except in 
emergency situations) at a thrust level greater than the 
standard 104 percent. On the other hand, should NASA de- 
termine that a higher engine thrust setting is needed for 
programmatic reasons, the Committee believes that the 
space agency should take whatever actions are required to 
ensure that adequate operating margins are present to 
maintain safety. 

The Committee has gone beyond the Rogers Commission 
in recommending a new system specification to overcome 
the inadequacies of the landing gear, tire, wheel, brake 
and nose wheel steering systems. The Committee also con- 
cluded that orbiter landings appear to be high risk even 
under ideal conditions, which seldom occur. 

The Rogers Commission stated that “there appears to be 
a departure from the philosophy of the 1960s and 19708 re- 
lating to the use of astronauts in management positions.” ? 
In contrast, after taking testimony from several former 
and current astronauts, the Committee could find no evi- 
dence that astronauts are denied the opportunity to enter 
management if they so choose. On the other hand, prior to 
the STS 51-L accident, astronauts were not encouraged to 
enter management. 


2 Rogers Commission Report, Volume I, p. 199. 
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In still other areas, the Committee has raised concerns that do 
not appear to have been addressed sufficiently by the Rogers Com- 
mission. We are concerned that: 


There are numerous other recurrent hardware problems 
that are either not fully understood by NASA or have not 
been corrected. 

The existing internal communication system is dissemi- 
nating too much information, often with little or no dis- 
crimination in its importance. Accordingly, recipients have 
difficulty “separating the wheat from the chaff.” 

Existing contract incentives used by NASA do not ade- 
quately address or promote safety and quality concerns— 
most emphasis is placed on meeting cost and schedule re- 
quirements. 

NASA does not yet understand how or why the deficien- 
cies in Solid Rocket Motor testing and certification went 
undetected in spite of the very comprehensive processes 
and procedures used by the agency to conduct and oversee 
these activities. The Committee is concerned that without 
such an understanding, NASA will not be able to protect 
against a similar breakdown in its system of checks and 
balances in the future. 

The Committee has concerns regarding the safety of the 
Filament Wound Case Solid Rocket Booster now under de- 
velopment by NASA, and recommends that the agency 
consider moving the heaviest Space Shuttle payloads to ex- 
pendable launch vehicles so that there will be no need to 
use Filament Wound Case Boosters. 

The Committee is not assured that NASA has adequate 
technical and scientific expertise to conduct the Space 
Shuttle program properly. NASA has suffered staffing re- 
ductions in key areas over several years. Moreover, it loses 
a significant number of technical/scientific personnel due 
to an imbalance between the government salary schedule 
and that of the private sector. The salary structure also in- 
hibits NASA’s ability to recruit top technical talent to re- 
place its losses. The record is not sufficient to warrant a 
formal finding on this matter. However, the Committee in- 
tends to conduct an in-depth review of NASA technical 
ability in the next Congress. 


On July 14, 1986, NASA submitted to the President a report on 
what actions the space agency plans to take in response to the rec- 
ommendations of the Rogers Cemmission.? The Committee believes 
that the plans contained in this report are a step in the right direc- 
tion. When fully implemented, these plans should substantially im- 
prove the safety of Space Shuttle flight operations. The Committee 
also endorses NASA’s decision to move the proposed date for the 
next Space Shuttle launch beyond June 1987. This is a realistic and 
responsible decision that has removed some unnecessary pressure 


з NASA, “Report to the President: Actions to Implement the Recommendations of the Presi- 
dential Commission on the Space Shuttle Challenger Accident," July 14, 1986. (Hereafter re- 
ferred to as NASA Response to Rogers Commission.) 
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from the government and contractcr personnel who must ensure 
that all hardware will be in readiness to reinstitute safe flight op- 
erations. 

Throughout the remainder of this report, the Committee address- 
es dozens of specific issues that relate to the Challenger accident. 
The Committee makes many recommendations for actions to be 
taken on the part of NASA to correct the problems that we have 
identified. The Committee directs NASA to report back to us by 
February 15, 1987, on how it is responding to each recommendation 
contained in this report. 

In closing, the Committee would like to state that it continues to 
believe in and remains committed to a vigorous civilian space pro- 
gram. The Committee also continues to believe that the Space 
Shuttle is a critically important element of that program. The 
Committee’s purpose, as NASA’s primary overseer in the House, 
must be to monitor, understand, and help correct where necessary 
the patterns in NASA which lead to weakened and ineffective oper- 
ation. 

We are at a watershed in NASA’s history and the Nation’s space 
program. NASA’s 28-year existence represents its infancy. We 
must use the knowledge and experience from this time to insure a 
strong future for NASA and the U.S. space program throughout 
the 21st century. 

This Committee has long been proud of the many awe-inspiring 
achievements of NASA and understands the importance of NASA’s 
programs to the future well-being of this country. We as a Commit- 
tee have perhaps exhibited the human inclination to accept the 
successful completion of a flight or event as an indication of the 
overall strength of all aspects of its planning and execution. Per- 
haps it is arrogant to dissect and interrogate relentlessly projects 
and programs that bring home repeated A’s for achievement and 
accomplishment. However, all of us—NASA, the Committee, the 
Congress and the Nation—have learned from the Challenger trage- 
dy that it is wisdom to do so, and it is a reflection of respect for the 
human fallibility that we all possess. 

We have no doubt that through the hard work and dedication of 
the men and women at NASA and its supporting contractors, the 
Space Shuttle will be safely returned to flight status—and will 
once again continue to impress people around the world with its 
many important accomplishments. 

As has been said many times since the January 28th tragedy, 
space flight is a high risk undertaking. The Committee accepts this 
fact and applauds those men and women who, in spite of this risk, 
have chosen manned space flight as a career. Though we grieve at 
the loss of the Challenger crew, we do not believe that their sacri- 
fice was in vain. They would not want us to stop reaching into the 
unknown. Instead, they would want us to learn from our mistakes, 
correct any problems that have been identified, and then once 
again reach out to expand the boundaries of our experience in 
living and working in outer space. 


ПІ. COMPILATION OF ISSUES, FINDINGS, AND 
RECOMMENDATIONS 


This compilation is taken from the body of the report. In order to 
facilitate the reader’s ability to refer to specific sections within the 
report, the outline in the following compilation corresponds to the 
Table of Contents and the body of this report: 


V. THE ACCIDENT 
A. INTRODUCTION 
Discussion Only 
B. SOLID ROCKET MOTORS 
1. History 


Issue 


Was there sufficient time to correct the problems with the Solid 
Rocket Motor? 

Findings 

1. Problems with the joints which connect the Solid Rocket 
Motor casings were recognized for many years. While attempts 
were made to correct these problems, the measures taken were in- 
sufficient to provide a reliable joint. 

2. The joint seal problem was recognized by engineers in both 
NASA and Morton Thiokol in sufficient time to have been correct- 
ed by redesigning and manufacturing new joints before the acci- 
dent on January 28, 1986. Meeting flight schedules and cutting cost 
were given a higher priority than flight safety. 


2. Summary of Casing Joint Design 


Issue 


Why did the aft field joint between the steel containers that hold 
the Solid Rocket Motor propellant fail to contain the burning gases 
of the propellant during lift-off and flight operations? 


Findings 

1. The design of the field joint was unsatisfactory and could not 
reliably contain the burning propellant gases under the range of 
operating conditions to be expected during the lift-off and flight 
phases. 

2. The O-ring materials and putty used in the design of the joint 
were unsatisfactory as used on the Shuttle, particularly during the 
winter months. Furthermore, neither NASA nor its contractor, 
Morton Thiokol, can adequately control the quality or consistency 
of these kinds of materials, which are made from recipes known 
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only by the manufacturer and which can be changed without certi- 
fication and approval. 


Recommendations 


1. NASA should write and issue a new and more accurate per- 
formance specification which would cover the full range of thermal 
and structural requirements for the Solid Rocket Motors, with an 
adequate factor of safety for unusually low temperatures. 

2. The Committee concurs with the Rogers Commission Report 
Recommendations on new joint design, but believes it is more ap- 
propriate to be more explicit in identifying the weaknesses in the 
joint design that need correction. 

3. The field joints of the Solid Rocket Motors should be rede- 
signed to account for the following features while providing a sig- 
nificant factor of safety: 

a. Movement in the joint, 

b. Proper spacing between tang and clevis, 

c. Seals made to withstand high and low temperatures under 
all dynamic thermal and structural loadings, 

d. Adequate sealing without the use of putty, 

e. Protection against insulation debonding and propellant 
cracking. 


3. Testing and Certification 


Discussion Only 
4. Manufacturing 


Discussion Only 
5. Stacking Operations 


Issue 


Was there any damage to the casing joints or contamination that 
occurred during the stacking operations when the Shuttle was as- 
sembled in the Vehicle Assembly Building (VAB) that could have 
contributed to the failure? 

Finding 

There was no evidence of joint contamination, fracture or other 
damage from foreign objects or due to casing ovality that contribut- 
ed to the joint failure. Although certain problems occurred during 


stacking and the procedures were violated once, there was no evi- 
dence that these events contributed to the Flight 51-1, accident. 


6. Summary of Launch Operations 


Issue 1 


How was the decision to launch STS 51-L arrived at and why 
was it wrong? 


Findings 
1. The Flight Readiness Review for STS 51-1, was conducted in 
accordance with established procedure. 


2. The decision to launch STS 51-L was based on a faulty engi- 
neering analysis of the SRM field joint seal behavior. 
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3. Compounding this erroneous analysis were serious ongoing 
weaknesses in the Shuttle Safety, Reliability and Quality Assur- 
ance Program which had failed to exercise control over the prob- 
lem tracking systems, had not critiqued the engineering analysis 
advanced as an explanation of the SRM seal problem, and did not 
provide the independent perspective required by senior NASA 
managers at Flight Readiness Reviews. 

4. The initial response of Marshall managers to the attempts of 
Thiokol engineers to raise the issue of temperature effects on the 
SRM seals caused Thiokol management to discount proper techni- 
je concerns and engineering judgment in their recommendation to 
aunch. 

5. The Director of Marshall’s Shuttle Projects Office may have 
violated NASA's Flight Readiness Review policy directive by failing 
to report the results of the January 27th teleconference to the As- 
sociate Administrator for Space Flight. 

6. The decision of the STS Program Manager to launch despite 
the uncertainty represented by ice on the Fixed Service Structure 
was not a prudent effort to mitigate avoidable risks to the Shuttle. 

7. The Launch Director failed to place safety paramount in eval- 
uating the launch readiness of STS 51-L. 

8. No launch should have been permitted until ice was cleared 
from the platform leading to the pad escape system. 

9. Ice Team personnel and Rockwell contractors properly con- 
veyed their inability to predict the post-ignition behavior of ice. 

10. Post-flight analysis indicates that ice did not exhibit the be- 
havior predicted by analysis, and that ice traversed a distance suf- 
ficient to strike the Shuttle during liftoff. 

11. Failure to enforce a clear requirement for definite readiness 
statements contributed to failures in communication between 
NASA and its contractors during launch preparations. 


Issue 2 


Should firing room personnel be allowed to waive launch commit 
criteria or equipment redlines during a launch countdown without 
a well-developed technical reason for doing so? 


Finding 
NASA's management waived its own launch commit criteria on 
January 28, 1986, without a valid technical reason for doing so. 
7. Retrieval, Transportation and Refurbishment 


Issue 


Were the motor casings used on STS 51-L damaged as a result of 
the retrieval, transportation and refurbishment operations follow- 
ing previous launches? 


Finding 
There was no evidence of damage to the casings or joint due to 
prior use or preparation for reuse. 
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С. EXTERNAL TANK 


Issue 


The External Tank was obviously involved in the accident. Was 
that involvement a cause or an effect? 
Findings 

1. The Committee adopts the "Finding" of the Rogers Commis- 
sion that: "A review of the External Tank's construction records, 
acceptance testing, pre-launch and flight data and recovered hard- 
ware, does not support anything relating to the External Tank 
which caused or contributed to the cause of the accident." 

2. The External Tank ruptured under the forces of a failed Solid 
Rocket Booster motor. These forces were far outside of any possible 


design considerations that could have been applied to the External 
Tank. 


D. CREW SURVIVAL 


Issue 

Was the accident of STS 51-L on January 28, 1986, survivable? 
Finding 

In the case of the tragic loss of the Space Shuttle Challenger and 


her crew on January 28, 1986, the Committee is convinced that the 
accident was not survivable. 


E. SABOTAGE 


Issue 

Could the accident have been caused by sabotage, terrorism, or 
foreign covert action? 
Finding 

The Committee is convinced that there is no evidence to support 


sabotage, terrorism or foreign covert action in the loss of the Chal- 
lenger. 


F. ADDITIONAL AVENUES OF INVESTIGATION 


Issue 


Could the accident have been caused by some failure other than 
failure of the joint between the casings? 


Finding 

As of September 15, 1986, the Committee has not found any cred- 
ible evidence to support any cause of the Challenger accident, other 
than the failure of the aft casings joint in the right-hand Solid 


Rocket Booster. Nor has there been any substantial evidence of a 
secondary or parallel failure on Flight 51-L. 
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УІ. DISCUSSION OF CRITICAL ISSUES 


A. TECHNICAL ISSUES 
1. Hardware Development and Production 
a. Problems in Hardware Certification 


Issue 1 


Have all elements of Space Shuttle flight hardware been ade- 
quately certified? 


Findings 


1. The overall design and certification processes prescribed by 
NASA for each major element of Space Shuttle flight hardware are 
very comprehensive. 

2. Prior to the STS 51-L accident, in spite of the comprehensive 
nature of NASA’s prescribed design and certification processes, in- 
sufficient testing had been conducted to permit an adequate under- 
standing by either Morton-Thiokol or NASA regarding the actual 
functioning of the Solid Rocket Motor joint. Also, the Solid Rocket 
Motor had not been adequately certified to meet the natural and 
induced environmental conditions that are stated in NASA’s design 
standards. The issue of whether or not standards were adequate is 
discussed in Section VII. 

3. The deficiencies in Solid Rocket Motor testing and certifica- 
tion persisted in spite of many reviews of the program by panels of 
experts: (1) within the manufacturer; (2) within NASA; and (8) from 
independent, outside groups. 

4. These deficiencies in testing and certification of one major ele- 
ment of the Space Shuttle system raise the possibility that other 
elements of flight hardware (or other sub-elements of the Solid 
Rocket Motor) could have similar deficiences. 

5. If NASA is unable to explain why the deficiences in Solid 
Rocket Motor testing and certification went undetected by the ex- 
isting comprehensive set of processes and procedures, the agency 
will not be able to protect against a similar breakdown in its 
system of checks and balances in the future. 


Recommendations 


1. NASA should devote more attention to determining why the 
deficiencies in Solid Rocket Motor testing and certification went 
undetected, so that appropriate action can be taken to uncover 
latent problems in existing hardware and to prevent similar prob- 
lems in future development programs. 

2. NASA and its contractors should thoroughly reassess the ade- 
quacy of all the testing and certification that has been conducted to 
date on each element of Space Shuttle flight hardware. Where дећ- 
ciencies are found, they must be corrected. 


Issue 2 


Does the Space Shuttle Main Engine have adequate operating 
margins, and is the “fleet leader" concept adequate to ensure safe 
operation? 
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Findings 


1. The Space Shuttle Main Engine is an impressive, technologi- 
cal achievement. However, it also is one of the higher risk ele- 
ments of the Space Shuttle system. Anomalous component perform- 
ance ог premature engine shutdown could prove catastrophic to the 
Space Shuttle and its crew. 

2. Some NASA officials familiar with the Space Shuttle Main 
Engine believe that it should be operated at a throttle setting of 
109 percent only in an emergency; others believe the engine could 
be safely operated at 109 percent on a routine basis. 

3. It is widely accepted that the Space Shuttle Main Engine 
would be safer if its operating margins (for temperature, pressure, 
operating time, etc.) were increased. 

4. The Committee agrees with the sense of Dr. Feynman’s con- 
cerns with respect to NASA's current “fleet leader" concept for 
certifying Space Shuttle Main Engine components, such as high 
pressure turbopumps, for flight. 

5. On a case by case basis, NASA regularly violates its own certi- 
fication requirements by permitting individual engine components 
to be used for flight even though they have accumulated an operat- 
ing time in excess of 50 percent of the two fleet leaders (i.e., in vio- 
lation of the “2Х” rule). 


Recommendations 


1. NASA should continue its active development program for the 
Space Shuttle Main Engine. The program should be focused more 
on increasing operating margins. 

2. Because of the safety concerns raised by some knowledgeable 
officials, NASA should give serious consideration to restricting use 
of the 109 percent engine throttle setting to emergency situations 
only. If NASA decides that it needs to use the 109 percent throttle 
setting for other than emergency situations, the space agency 
should take whatever actions are required to ensure that adequate 
margins are present to maintain safety. 

3. NASA should closely scrutinize each of the concerns raised by 
Dr. Feynman regarding the agency's "fleet leader" concept for cer- 
tifying Space Shuttle Main Engine components. The agency should 
also closely reassess its practice of selectively violating its "2X" 
rule for some Main Engine flight hardware elements. 


b. Recurrent Hardware Problems 


Issue 


What resolutions of inadequacies revealed in the landing gear, 
tires, wheels, brakes, and nose wheel steering of the landing and 
deceleration system are required? 


Findings 

l. The Orbiter landing gear, tires, wheels, brakes, and nose 
wheel steering, as a system, is experimental, designed to criteria 
outside any other experience, and uses unique combinations of ma- 


terials. The original design performance specifications for speed 
and landing weights are routinely exceeded. The original design 
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did not consider asymmetrical braking for cross wind steering as 
the normal case, although it has become standard practice. Stresses 
which were not taken into account in the design have surfaced in 
as yet a very small real world sample. 

2. As a consequence, Orbiter landings appear high risk even 
under ideal conditions, which seldom occur. Exceptional procedural 
and skill demands are placed upon the pilots to nurse the brakes 
and tires through every landing. Landing rules have had increas- 
ing constraints imposed that hamper cperational flexibility and 
usefulness of the Orbiter. 

3. Brake and tire damage have been evident since early on in 
the program. The Rogers Commission seems very correct in finding 
the current landing gear system unacceptable. Resolution of land- 
ing gear system problems can no longer be put off. 


Recommendations 


The Committee recommends that NASA: 

1. Assemble all of the fragmented studies, analyses, and conclu- 
sions on landing gear problems and integrate them into one engi- 
neering description of the system as it is now intended to be used. 
This should include consideration of the basic strength of the struts 
themselves and their attachments. 

2. Write a new system specification and match the proposed 
design improvements to an acceptable reliability and certification 
specification. 

3. Design a test and certification program adequate to meet cri- 
teria to fly and to continue well into future operations until under- 
standing and confidence in the landing gear system is attained. 

4. In anticipation of requirements for a new brake specification, 
accelerate a program to provide: 

Increased brake mass and/or heat sink, 

Substantial increase in energy absorption, 

Evaluation which weighs the experimental nature of the pro- 
posed 65 million foot pound carbon brake and its impact on the 
system against the penalty of weight of known materials (e.g. 
steel) for operational confidence. 

5. Write updated subsystem specifications to upgrade the landing 
gear system to acceptable levels of performance to respond to the 
Rogers Commission’s recommendations. 


Issue 2 

What actions should be taken relative to other recurrent prob- 
lems with flight hardware? 
Finding 

There have been many instances of in-flight anomalies and fail- 
ures of other elements of Space Shuttle hardware, some involving 
mission critical pieces of equipment. Some of these past problems 
have been corrected while others have not. 
Recommendation 


NASA should ensure that before reinstituting Space Shuttle 
flight operations, it fully understands and has corrected all in- 
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stances of serious in-flight anomalous behavior or failures involv- 
ing mission critical pieces of flight hardware. 


c. Other Engineering Concerns 


Issue 


What action should be taken relative to other engineering con- 
cerns regarding critical elements of Space Shuttle flight hardware? 


Finding 
In recent years, serious engineering concerns have been raised 
regarding the safety of some elements of Space Shuttle flight hard- 


ware, such as the 17 inch flapper valve and the heat exchanger 
feeding the liquid oxygen tank. 


Recommendations 


1. NASA should ensure that, as a part of its current review of 
Space Shuttle safety, it identifies, thoroughly evaluates, and then 
takes appropriate action on all serious engineering concerns raised 
regarding mission critical elements of Space Shuttle flight hard- 
ware. 

2. NASA should give special attention to both the cost and risks 
of using Filament Wound Case Solid Rocket Boosters for very 
heavy Space Shuttle payloads versus the cost and programmatic 
impacts of simply transferring those payloads to expendable launch 
vehicles. 


а. Desirable Tests Not Yet Approved 


Issue 1 


Is the current ground test program for the SSME adequate to 
provide a complete understanding of the engine’s operating charac- 
teristics and safety margins? 

Findings 

1. The Committee supports the Findings and Conclusions of the 
Development and Production Team concerning the SSME, particu- 
larly the concern that “Hardware availability and the potential of 
damage to hardware and facilities resulting from tests malfunc- 
tions have constrained . . . [full margin] . . . testing during the 
ground test program." 

2. The Committee shares Dr. Feynman's concern that there has 
been a slow shift toward decreasing safety in the SSME program. 

3. There is not a sufficient understanding of SSME blade cracks 
and fractures. 


Recommendations 


1. The Committee concurs with the Development and Production 
Team conclusion that overtesting, limits testing, and malfunction- 
testing in the SSME program should be re-emphasized to demon- 
strate full engine capability. 

2. NASA should prepare and submit to the Committee a cost- 
benefit analysis of testing a SSME to destruction including: (a) uti- 
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lizing additional SSME test stands; (b) utilizing additional hard- 
ware for the ground test program; and (c) the value of such a test. 

9. А vigorous study of fracture behavior should be conducted to 
minimize the hazard of cracked SSME blades and to increase the 
reliability and safety margin of blades. New blades and/or new 
policies for duration of blade use should be incorporated prior to 
the next Shuttle launch. 


Issue 2 


Is the leak/combustion threat of the External Tank's hydrogen 
pressure valve a hazard warranting testing? 


Findings 

1. The Committee supports the Rogers Commission concern re- 
garding the hazard posed by the liquid hydrogen vent and relief 
valve. 

2. The Committee supports the intent of the ET prime contrac- 


tor, Martin Marietta, to pursue outdoor wind tunnel testing to 
eliminate the liquid hydrogen vent/relief valve hazard. 


Recommendation 

NASA, in conjunction with the appropriate contractor, should 
consider designing and conducting an ET liquid hydrogen leak/ 
burn test to determine if corrective actions should be taken prior to 
the next Shuttle flight. 


Issue 3 


Does the present Range Safety System (RSS) on the External 
Tank present an unreasonable risk? 


Finding 
There is substantial controversy over the relative benefits and 
risks of the present RSS on the External Tank. 


Recommendation 

The Committee believes the Administrator should prepare and 
submit to the Committee a comprehensive review of RSS require- 
ments. 


e. Production/ Refurbishment Issues 


Issue 1 


Should 100 percent X-ray inspection of the propellant and insula- 
tion for the Solid Rocket Motors (SRM) be resumed? 


Findings 

l. Previous X-ray inspection led to only one SRM being rejected 
for Shuttle use. 

2. There is no non-destructive inspection method which can 
guarantee a defect-free SRM. X-ray inspection cannot detect “kiss- 
ing" voids in which the SRM insulation is touching the SRM steel 
casing but is not bonded to it. Debonded insulation at the end of an 
SRM segment could provide burning propellant gases with a path 
to the SRM steel casing and could result in loss of vehicle and 
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crew. X-ray inspection can detect propellant cracks and large voids 
which if undetected could also result in a catastrophic situation. 

3. Although there is no guarantee that X-ray inspection has been 
a particularly effective method of detecting propellant and insula- 
tion SRM flaws, it remains one of the best available methods to 
monitor the SRM manufacturing process. 


Recommendations 


1. NASA should consider reinstating full X-ray inspection of the 
propellant and insulation for all motors used on succeeding flights 
until new, more accurate inspection methods can be developed and 
implemented and there is unquestionable confidence in the SRM 
production process. 

2. NASA, in conjunction with the appropriate contractors, 
should investigate the development of new, more accurate inspec- 
tion techniques which can detect "kissing" voids and other poten- 
tial defects that cannot be detected by X-ray inspection. 


Issue 2 


Are all production and other activities involving Criticality 1 and 
1R hardware at prime and secondary contractor facilities labeled 
as “critical” processes? 

Findings 

1. Critical processes are formally identified and controlled by 
NASA. All processes are classified and controlled by the contrac- 
tor’s Process Change Control Board. 

2. The O-ring used in the case joint is critical to the sealing in- 
tegrity of the joint, yet it is not designated as а "critical" process 
by either the Parker Seal Co. or Hydrapack, the manufacturer and 
supplier respectively. This raises the possibility that other Critical- 
ity 1 and 1R hardware components are also not appropriately des- 
ignated by their manufacturer as “critical” processes. 


Recommendations 


1. NASA should require the manufacture of critical items, such 
as the O-rings, to be designated "critical" processes. Contractors 
should formally notify their employees involved in critical manu- 
facturing processes of the serious nature of particular production 
processes. 

2. NASA should conduct a thorough review to ensure that all 
manufacturing processes involving Criticality 1 and 1R hardware 
components of prime and secondary contractors are appropriately 
designated “critical” processes. 


Issue à 

Do O-ring repairs compromise safety? 
Finding 

The Committee supports the Development and Production Team 
Finding and Conclusion that the "limit of five repair joints per O- 
ring is an arbitrary number" and that "repair of inclusions and 


voids in the rubber . . . appears to be an area of potential prob- 
lem." 
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Recommendation 


NASA should review its O-ring repair policy and contractor 
repair practices in terms of their effects on O-ring performance and 
safety. Such review should be completed prior to the resumption of 
Shuttle flights if, as anticipated, the new SRB joint design uses O- 
rings. 


Issue 4 


What impact does growth of SRM case size have upon booster 
and Shuttle performance and safety? 


Finding 
The Committee concurs with the Development and Production 
Team Finding that “Remeasurement of two used SRM case seg- 


ments indicated both tang and clevis sealing surfaces have in- 
creased in diameter beyond the anticipated design limits." 


Recommendation 


NASA and the appropriate contractor should resolve through 
analysis and testing prior to the next Shuttle flight the cause of 
SRM case size growth and its impact upon booster and Shuttle per- 
formance, reliability of refurbished SRM case segments, and safety. 


ј. Review of МАЗА 8 Redesign/Recertification Plan 


Issue 


Is NASA's SRM redesign and hardware recertification plan a 
viable and realistic one which will result in a safer, more reliable 
Space Transportation System? 


Findings 

1. NASA's SRM redesign plan is a step in the right direction. 
Moving the proposed launch date beyond June 1987 is a responsible 
and realistic decision. The membership of the SRM Redesign Team 
is representative of qualified individuals in and outside of NASA. 
With the expert assistance of the specially appointed National Re- 
search Council (NRC) Independent Oversight Group, the new SRM 
design should be a significantly safer and more reliable Shuttle ele- 
ment. 

2. NASA's current hardware recertification plan is also a step in 
the right direction. The use of independent review contractors dis- 
tinguishes this recertification plan from earlier reviews. However, 
given the failure of previous reviews to discover the deficient SRB 
joint certification, the Committee is concerned there is still the pos- 
sibility that the recertification effort may not reveal other certifica- 
tion deficiencies, if indeed they exist. The plan also raises concern 
about the qualifications of independent reviewers to evaluate cer- 
tain elements given the uniqueness of particular Shuttle compo- 
nents. 

8. The joint was never fully tested as a separate element of the 
SRM. The various forces that act on the joint during stacking, 
launch, and flight are difficult, if not impossible, to duplicate in a 
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test of the joint under all conditions that could be experienced 
during launch and flight. 

4. It is unclear what function the new Safety Office will perform 
in the redesign of the SRB field joint and other critical elements of 
the Shuttle, as well as NASA’s recertification plan. 


Recommendations 


1. The Committee recognizes the national need to return the 
Shuttle to flight status as soon as reasonably possible. As noted in 
NASA’s July 14, 1986, report to the President, safety will deter- 
mine the launch schedule. However, NASA should consider the 
proposed launch date of early 1988 as a flexible one which should 
be slipped further if necessary. The Shuttle should not be launched 
again until NASA can assure that safety criteria have been met. 

2. In establishing a test program to certify the new Solid Rocket 
Motor design, NASA should consider the feasibility of including in 
combination and in the proper sequence all of the thermal and 
structural loads expected to be experienced by the Solid Rocket 
Motor during ignition, lift-off, and flight. 

3. The independent review contractors participating in the hard- 
ware recertification plan should utilize sufficient specific technical 
— to insure adequate recertification of all elements of the 


4. The Committee requests that the new Office of Safety, Reli- 
ability and Quality Assurance conduct an independent assessment 
of the SRB field joint redesign efforts. In addition, the new office 
should also be integrally involved in reviewing all other critical 
component redesign efforts and NASA’s recertification plan. 


2. Operations 
a. Shuttle Processing Issues 


Issue 


In 1983, NASA consolidated fifteen separate contracts and 
awarded a single Shuttle Processing Contract (SPC) encompassing 
all ground processing related to launch and landing of the Space 
Shuttle. There are two issues associated with this contract: (1) How 
should is the concept of a unified SPC; and (2) How well has the 
SPC contractor actually performed? A related issue is the quality 
of essential logistical support, especially spare parts, provided to 
the contractor by NASA. 

Findings 

1. Performance under the SPC has improved since the inception 
of the contract. However, up to the time of the Challenger accident, 
contractor performance continued to be plagued by excessive over- 
time, persistent failures to follow prescribed work procedures, and 
inadequate logistical support from NASA. 

2. High overtime rates have hampered SPC performance. Over- 
time rates had increased significantly during the six months prior 
to the Challenger launch, to the point that critical personnel were 
working weeks of consecutive workdays and multiple strings of 11 
and 12-hour days. Fatigue resulting from work patterns of this sort 
can constitute a threat to safety. Їп fact, worker fatigue was a con- 
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tributing factor in а mission-threatening incident on Flight 61-C, 
the mission immediately prior to the January 28 Challenger 
launch. 

3. There are numerous documented cases where contractor em- 
ployees failed to comply with guidelines for carrying out assigned 
duties, including specific “Operations and Maintenance Instruc- 
tions" (OMIs). Such failures contributed to both of the major mis- 
haps in 1985 involving Shuttle processing—namely, the November 
8, 1985, "handling ring" episode which led to significant damage to 
a Solid Rocket Motor segment slated for use on STS 51-L, and the 
March 8, 1985, "payload bay access platform" episode which led to 
significant damage to bay payload bay door. Failure to follow an 
OMI also led to improper (and mission-threatening) handling of the 
hydrogen disconnect valve during the 51-L launch operations. All 
of these incidents show a lack of discipline, both with respect to fol- 
lowing prescribed procedures and with respect to reporting viola- 
tions of these procedures. 

4. At the time of the Challenger accident, the lack of spare parts 
caused a degree of cannibalization (i.e., the removal of a part from 
one Orbiter to satisfy a need for a spare part on another Orbiter), 
which was the highest in the history of the Shuttle program and 
which was a threat to flight schedule and flight safety. Excessive 
cannibalization leads to multiple installations, retesting, added doc- 
umentation, delayed access to parts, and increased damage poten- 
tial. Ав a result, cannibalization contributes directly to excessive 
overtime. 

9. There is no clear evidence whether or not greater involvement 
of the development contractors would improve Shuttle operations. 


Recommendations 


1. Because of the serious quality and safety concerns surround- 
ing the contract, NASA should conduct a careful review of Shuttle 
processing, the SPC contract, and the relationship of flight hard- 
ware contractors and report its findings, recommendations, and 
proposed contract modifications to the Committee. NASA's reexam- 
ination should include a comparison of efficiency and safety under 
the SPC versus efficiency and safety during pre-1983 Shuttle proc- 
essing operations, which heavily involved the development contrac- 
tors. 

2. NASA should examine the issues of spares availability and 
cannibalization and provide the Congress with a management and 
budgetary plan for correcting previous logistical problems. 

3. NASA should stop routine cannibalization and develop guilde- 
lines (including appropriate control and review procedures and 
roles for the SR&QA office) governing permissible cannibalization. 

4. The Committee recommends that NASA provide its re-invig- 
orated safety office with the authority to enforce scheduling that 
leads to safe overtime rates. 


b. Pressures on Shuttle Operations 


Issue 


Was NASA under pressure to fly more flights? How did this 
pressure originate? Will it recur? 
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Findings 

1. The Congress and the Executive Branch jointly developed the 
policy that the Space Shuttle should, in a reliable fashion and at 
an internationally competitive cost, provide for most of the Free 
World’s space launch needs. By and large, both Branches failed to 
appreciate the impact that this policy was having on the operation- 
al safety of the system. 

2. NASA was under internal and external pressure to build its 
Shuttle flight rate to 24 per year, primarily to reduce costs per 
flight, but also to demonstrate and achieve routine access to space. 
NASA has never achieved its planned flight rate. 


Recommendations 


1. NASA must not attempt to achieve a flight rate beyond that 
which (1) can be supported by the budget and staff resources avail- 
able; and (2) is consistent with the technical maturity of the Shut- 
tle and the flexibility desired and needed in scheduling payloads. 
Management should ensure efficient use of resources but should 
not impose a flight rate on the system. 

Once operation of the Space Shuttle resumes, the Committee 
should maintain a close and continuous oversight of Shuttle flight 
rate, planning, and operations. The Committee should ensure both 
that flight rate flows logically from the resources provided and that 
flight safety is not compromised beyond acceptable limits. 


с. Impact of Pressures on Shuttle Operations 


Issue 


Did operating pressures adversely affect the safety of the Shuttle 
program? 
Findings 

1. The pressure on NASA to achieve planned flight rates was so 
pervasive that it undoubtedly adversely affected attitudes regard- 
ing safety. 

2. The pressure to achieve planned flight rates was compressing 
mission preparation as earlier missions were delayed due to unfore- 
seen problems. Had the accident not occurred there would soon 
have been a collision between planned launch dates and mission 
preparation needs which could not have been met by overtime, can- 
nibalization, or other undesirable practices. Operating pressures 
were causing an increase in unsafe practices. 

3. The schedule of payloads planned to fly on the Shuttle (the 
manifest) was frequently changed. Each change rippled through 
the NASA Shuttle organization and through the manifest and, es- 
pecially if made shortly before launch, would increase the demands 
on personnel and resources in order to achieve the planned flight 
rate. 

4, The Space Shuttle has not yet reached a level of maturity 
which could be called operational as that term is used in either the 
airline industry or the military. Each Shuttle flight is fundamen- 
tally unique, and requires unique preparations. Therefore, small 
changes in a mission can cause significant perturbations of mission 
planning and crew training. 
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Recommendations 


1. The new Associate Administrator for Safety, Reliability and 
Quality Assurance must assure that any pressures to increase the 
Shuttle flight rate do not adversely influence mission preparation. 
The Associate Administrator must have the authority not only to 
stop a particular flight, e.g., at a Flight Readiness Review, but to 
stop the whole mission planning process if necessary. 

2. Where appropriate, NASA should take steps to make the mis- 
sion planning process standard and routine to reduce the time and 
resources needed to plan a mission. Before requesting more re- 
sources for the existing mission planning process (manpower, facili- 
ties, equipment), NASA should identify ways to improve the proc- 
ess. 


d. Other Safety Issues 


Issue 1 


What is the criticality of landing safety associated with pro- 
grammed and abort landing sites and their local characteristics? 


Findings 


1. The Committee finds that many of the normal and abort land- 
ing safety problems will be alleviated when the Rogers Commis- 
sion's and the Committee's (Section VI. A. 1. b., this report) recom- 
mendations to upgrade the landing gear system are implemented. 
When the landing gear system is understood, straightforward cal- 
culations and operational rules will determine acceptable runway 
dimensions and conditions. 

2. The Committee found no reason to fault NASA's current pro- 
cedure on launch constraints based upon operational judgment and 
conservative rules on local conditions at planned abort and landing 
sites. However, since an obvious finding is that the Orbiter is a de- 
velopmental system, it is axiomatic that unanticipated "4ісеу" cir- 
cumstances will arise. 

3. It was found that for the least landing gear system stress, 
runway preference is Edwards Air Force Base (EAFB) (concrete), 
KSC, and Rogers Dry Lake (EAFB "lake bed") in that order. No 
reason was found to invalidate the KSC runway design. The rea- 
sons for the "dry" course surface still prevail over concern about 
wear on tires designed for one landing. Additional constraints at 
KSC because of lesser lateral stabilized overrun area may be 
needed to bring its safety to the level of the EAFB runway. 

4. The NASA Landing Safety Team's proposal to provide stand- 
ard landing aids and arresting barriers at all sites and their em- 
phasis on runway surface characteristics for repetitive tire use 
takes on a new dimension that is in addition to the Rogers Com- 
mission's recommendations. 

5. Weather, by far, is the most significant factor governing oper- 
ational decisions, Orbiter damage, and landing safety. The con- 
straint is simply that acceptable weather must be forecast with 
confidence within the time frame needed. Ultra-conservative rules 
prevail because of the predictable unpredictability of Cape weather. 
New and innovative local weather analysis and forecasting re- 


24 


search is a high priority. The African Coast and southwestern 
United States sites enjoy more stable and predictable weather. 


Recommendations 


The first priority to achieve an acceptable degree of landing 
safety and to have a sensible base to work from for improvement is 
to implement the recommendations of the Rogers Commission and 
the Committee on the landing gear system improvements to attain 
an operational capability. Then: 

Instrument the system, and schedule all landings at Edwards 
runway for systematic concurrent testing until the landing 
gear system is understood. 

Write a clean sheet set of rules based on results. 

Determine the risk of accident with the B-747 Shuttle Carri- 
er Aircraft (SCA) and its impact upon the Shuttle program. 

Extend every reasonable effort to assure a mission planning 
process to minimize the need for abort site landings. 

Reevaluate and determine the degree of risk acceptable at 
abort site landings and bring abort site capability up to meet 
that risk level. 

Expand astronaut matched team flight landing practice to 
cover all known exigencies. Propose additional training craft if 
necessary. 

Join in a venture with NOAA to invent new technology and 
techniques to learn new ways to understand the dynamics of 
Cape Kennedy weather phenomena to supplant current inad- 
equacy to forecast two hours ahead. 


Issue 2 


Has adequate provision been made for crew safety in case of in- 
flight emergencies? That is, has adequate provision been given to 
launch abort options and crew escape options? 

Findings 

1, Crew escape options were considered when the Shuttle was 
originally designed and the basic situation has not changed. Many 
initially attractive options do not significantly reduce risk to the 
crew either because they may not reduce exposure to the principal 
hazards or because they add risks of their own. 

2. A crew escape system for use in controlled gliding flight might 
be feasible and worthwhile. 

3. Crew escape during the ascent phase appears infeasible. 

4. Launch abort during SRB burn appears impossible but it may 
be possible to decrease risk to the crew after SRB separation, pri- 
marily through mission design. 


Recommendation 


NASA should continue to respond to the recommendations of the 
Rogers Commission regarding (i) crew escape during controlled 
gliding flight and (ii) increasing the possibility of successful emer- 
gency runway landings. NASA should reexamine all crew survival 
options and report to the Committee on its findings. 
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В. MANAGEMENT ISSUES 
1. Technical Management 
a. Risk Management Issues 


Issue 


Is there a coordinated and effective risk management program in 
the NSTS? 
Findings 

1. NASA does not explicitly use a centralized program that co- 
ordinates all the factors that encompass an adequate risk manage- 
ment program. 

2. As a result of the accident, NASA is reexamining the Failure 
Modes and Effects Analyses (FMEA) and Hazard Analyses (HA) to 
reassess risks associated with the designs of Shuttle subsystems. 

3. NASA’s lack of statistical data on the performance of certain 
components will limit the usefulness of sound engineering judg- 
ment in much the same way as it limits the usefulness of probabi- 
listic risk assessment. 


Recommendations 


1. NASA should develop and provide to the Committee a descrip- 
tion of an overall risk management program as it relates to the 
Space Shuttle. This effort should include a determination of wheth- 
er or not a more centralized coordination of a risk management 
program and issuance of direct risk management guidance direc- 
tives are needed. 

2. NASA should review analytical methods utilized in the per- 
formance of risk assessment, including statistical analyses, trend 
analyses and probabilistic risk assessment methodologies to deter- 
mine their applicability to the NSTS program. Assistance from the 
National Academy of Sciences, or other appropriate organizations 
with expertise in these matters, may be required to adequately per- 
form this review. 

3. NASA should review its certification testing to ensure that all 
critical items are adequately tested. Data obtained from these tests 
should be used when appropriate in conducting a formal risk as- 
sessment. 


Ь. Launch Decision Process 


Issue 1 


Is the process for establishing launch constraints and dealing 
with them effective? 
Findings 

1. There is no clear understanding or agreement among the vari- 
ous levels of NASA management as to what constitutes a launch 
constraint or the process for imposing and waiving constraints. 

2. Launch constraints were often waived after developing a ra- 
tionale for accepting the problem rather than correcting the prob- 
lem; moreover, this rationale was not always based on sound engi- 
neering or scientific principles. 


64-420 0 - 86 - 2 
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Recommendations 


1. NASA should establish rigorous procedures for identifying and 
documenting launch constraints. The individual(s) responsible for 
implementing this procedure should be clearly identified, and well 
vus and understood criteria for waiving them should be estab- 
ished. 

2. NASA should exercise extreme caution in waiving launch con- 
straints before correcting the problem that led to the launch con- 
straint. The rationale should be based on rigorous scientific/engi- 
neering analyses or tests and should be understood and accepted by 
the program manager. 


Issue 2 


Are the Launch Commit Criteria procedures adequate to ensure 
the safety of the mission? 
Findings 

1. The procedure used for developing launch commit criteria is 
systematic and thorough; however, violations of the criteria do not 
necessarily mean “по go". Therefore, NASA sometimes has relied 
on engineering judgments made during the terminal countdown in 
determining whether to launch. 

2. Launch commit criteria were sometimes waived without ade- 
quate engineering analysis or understanding of the technical rea- 
sons for establishing the criteria. 


Recommendations 


1. NASA should review the launch commit criteria procedures, 
especially those for dealing with violations, to lessen the reliance 
on engineering judgments under stress. 

2. When situations arise where “real time" judgments are un- 
avoidable, NASA should adopt a more conservative approach to 
waiving previously established criteria. In no case should a crite- 
rion be waived without a thorough understanding of the rationale 
for the establishment of the criterion. 


Issue 3 


- Are launch readiness review procedures and communications 
adequate? 
Finding 

The Committee finds that the review procedures and communica- 
tions used to assure flight readiness were systematic, thorough, and 
comprehensive and provided ample opportunity for surfacing hard- 
ware problems prior to flight. Level I FRRs are usually recorded 
(audio); however, there is often no record made of other key pre- 
launch meetings. 


Recommendation 


NASA should make every reasonable effort to record meetings 
where key decisions might be made; in particular, all formal Flight 
Readiness Reviews, including the L-1 and the Mission Manage- 
ment Team meeting should be recorded, where feasible by video. 
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Issue 4 


Was the failure to inform the Level I ог Level II Program Man- 
agers of the Teleconference involving NASA and Morton Thiokol 
on the eve of the launch a factor in the decision to launch? 
Findings 

1. The Committee finds that Marshall management used poor 
judgment in not informing the NSTS Program Manager or the 
Level I Manager of the events that took place the night before the 
launch, specifically the stated concerns of the Thiokol engineers. 
However, the Committee finds no evidence to support a suggestion 
Еј the outcome would have been any different had they been 

2. The Committee finds the efforts of Thiokol engineers to post- 
pone the launch commendable; however, Thiokol had numerous op- 
portunities throughout the normal flight readiness process follow- 
ing flight 51-C in January 1985 to have the new minimum temper- 
ature criteria established. 


Issue 5 

Do the principal contractors have an appropriate role in the 
launch decision making process? 
Finding 

The principal contractors have an active role throughout the de- 
cision making process right up to the launch; however, the lack of 
a firm requirement for their concurrence at the time of launch 
does partially relieve them of responsibility for mission success. 
Recommendation 

Principal contractors should be required to make a clear, unam- 
bigous statement concerning launch readiness just prior to launch. 
Issue 6 

Are astronauts adequately represented in the decision making 
process? 
Finding 

The astronauts believe they currently have the opportunity to 


make inputs into the process and are reluctant to assume a greater 
responsibility for the decision to launch. 


c. Technical Expertise of Personnel 


Issue 


Does NASA have an adequate level of in-house technical exper- 
tise to manage the Shuttle Program properly? 


Findings 

1. During the last decade NASA has had significant decreases in 
manpower. A disproportionate reduction may have occurred in the 
safety, reliability and quality assurance staff at NASA headquar- 
ters and at the Marshall Space Flight Center. Additionally during 
the period preceding the Challenger accident, the Office of Space 
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Flight also suffered a decline in staff. The decreases may have lim- 
ited the ability of those offices to perform their review functions. 

2. The information presented to NASA headquarters on August 
19, 1985 was sufficient to require immediate and concentrated ef- 
forts to remedy the joint design flaws. The fact that NASA did not 
take stronger action to solve this problem indicates that its top 
technical staff did not fully accept or understand the seriousness of 
the joint problem. 


Recommendations 


1. NASA should review the numbers and qualifications of key 
staff in technical and management positions and should consider 
additional training and recruitment of individuals to further the 
quality and safety of NASA’s missions. 

2. The Committee should maintain on-going oversight of this 
analysis and conduct an in-depth examination upon the conclusion 
of NASA’s review. 


d. Change Control Process 


Issue 1 


Has the pressure to maintain operational flight rates and sched- 
ules for the Shuttle compromised the hardware Change Control 
Process? 

Findings 

1. When NASA declared the Space Shuttle to be an operational 
system, additional pressure to increase flight rates impacted other 
aspects of the overall program such as the ability to implement, 
evaluate, test, and certify changes in hardware design. 

2. As a result of attempting to operate the Shuttle at increased 
flight rates, controlling other aspects of the program such as the 
flight production process and manifest also became a more complex 
and difficult aspect of program administration. 


Recommendations 


1. NASA must reconsider its efforts to categorize the Shuttle as 
an operational transportation system. 

2. The Configuration Management System designed to control 
such changes must be reexamined by NASA as to its effectiveness 
in assuring that all hardware changes take place in a safe and reli- 
able fashion. 


Issue 2 


Is the change control process sufficiently defined for all elements 
of the Shuttle system? 
Findings 

1. The NSTS engineering and process change guidelines are, for 
the most part, sufficiently well-defined for the majority of the sub- 
systems that comprise the Space Shuttle. | 

2. NASA gives the same level of scrutiny to changes involving а 


minor component (such as moving velcro strips in the Orbiter) as 
those involving mission critical elements of flight hardware. 


29 


Recommendation 


NASA should review its change control process to determine the 
usefulness of differentiating between minor changes and significant 
changes. 


2. Organization and Policy Management 
a. Management Structure 
Issue I 


Does the management of the Shuttle Program adequately define 
the lines of authority and are managers given authority commen- 
surate with their responsibilities? 

Finding 

The management of the Shuttle Program is complex and diversi- 
fied and it is not always clear who has authority or responsibility. 
NASA's “lead center" concept has resulted in placing the manage- 
ment of the program at JSC, one of three centers participating in 
the program; however, because Johnson does not have control of 
the other centers' resources, the NSTS Program Manager's author- 
ity to manage the program is limited and the responsibility is un- 
clear. 


Recommendation 


NASA should restructure the Shuttle Program management to 
define clear lines of authority and responsibilities. This restructur- 
ing should take into account the special role each center must play 
and be especially sensitive to the need for the cooperation and sup- 
port of all the participants to achieve a common goal. NASA 
should give special consideration to moving the Program Manager 
to NASA Headquarters to avoid the confusion and inter-center ri- 
valry that result from having a large multi-center program man- 
aged out of one of the participating centers. 


Issue 2 
Are astronauts adequately represented in management? 
Finding 
The Committee finds no evidence that astronauts are denied the 
opportunity to enter management if they so choose. 
b. Communication 


Issue 1 


Are there adequate opportunities to communicate problems 
within the Shuttle Program management structure? 


Finding 

There are many regularly scheduled meetings and telecons at all 
levels of management throughout the Shuttle Program. In addi- 
tion, “special” meetings and telecons are routine. No evidence was 
found to support a conclusion that the system inhibited communi- 
cation or that it was difficult to surface problems. 
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Issue 2 


Is too much information being disseminated so that important in- 
formation is lost? 


Finding 
Large amounts of information are disseminated on a routine 


basis, often with little or no indication of its importance to all of 
the recipients. 


Recommendation 


NASA management should review the process of providing infor- 
mation on significant actions so that awareness by concerned man- 
agers is assured. 


Issue 3 


Are communications filtered so that important information is 
prevented from reaching the decision makers? 
Finding 

NASA managers delegated the responsibility for making techni- 
cal judgments to lower level managers or assistants. Therefore, the 
information that reached the top decision makers was "filtered" in 
that it was interpreted by others that were presumed to have more 
specialized experience or expertise in a given area. There is no evi- 
dence that middle level managers suppressed information that they 
themselves deemed to be significant. In fact, as discussed in the 
section on technical expertise, the failure was not the problem of 
technical communications, but rather a failure of technical decision 
making. 


c. Safety, Reliability and Quality Assurance 


Issue 1 


Is NASA’s decision to establish a new Office of Safety, Reliability 
and Quality Assurance appropriate and, if so, what should its role 
be? 

Finding 

The Committee finds that the Rogers Commission recommenda- 
tion that NASA should establish an Office of Safety, Reliability 
and Quality Assurance that reports directly to the Administrator is 
indeed appropriate. However, it is not clear what the activities of 
this office will encompass. 


Recommendations 


1. The Associate Administrator for Safety, Reliability and Qual- 
ity Assurance (SR&QA) should provide to the Committee the agen- 
cy's draft plan delineating the organization, goals, implementation 
strategies and resource requirements of the Office of SR&QA. 

2. After the Office of SR&QA is fully operational, the Committee 
will wish to continue oversight over its activities. 
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Issue 2 


Has NASA applied sufficient resources to support adequate 
SR&QA efforts within the NSTS program? 


Findings 


1. The Committee finds that reductions in NASA civil service 
personnel that have occurred over the past decade have adversely 
impacted the agency’s ability to maintain the appropriate level of 
oversight and control of the SR&QA activities within the NSTS. 

2. NASA has become increasingly dependent upon outside 
SR&QA support from the Department of Defense (Defense Contract 
Administration Services (DCAS) and Air Force Plant Representa- 
tive Office [АКРКО) and contractors. 

3. NASA has reduced or reassigned to other program areas in- 
house safety, reliability and quality assurance tasks such as test- 
ing, analyses and instrumentation and has reduced or shut down 
in-house facilities for performing SR&QA research and technology 
development. The degree to which these factors have adversely im- 
pacted the safety, reliability and quality assurance activities within 
the NSTS program has not been adequately assessed. 


Recommendations 


1. NASA should establish and maintain a strong and effective 
SR&QA program. Continuing support for such a program must 
come directly from the Administrator. 

2. Although it is appropriate to establish strong contractor capa- 
bilities in the areas of SR&QA, the internal oversight responsibil- 
ities and coordination of SR&QA tasks must be the responsibility of 
NASA itself. In order to assure that the appropriate interfaces 
among the various subsystem elements that comprise the NSTS are 
maintained, a sufficient complement of NASA SR&QA manage- 
ment and support staff must be available to perform the necessary 
oversight and coordination tasks. 


Issue 3 


Are the responsibilities of safety engineers and design engineers 
adequately specified within NASA’s “risk management” program? 


Finding 

The roles of safety, design as well as reliability engineers are not 
adequately and uniformly defined throughout the NSTS program. 
In some cases, the Committee learned that safety engineers were 
not participating in major decisions related to flights of the Shut- 
tle. 


Recommendation 


It should be the responsibility of the new Associate Administra- 
tor for SR&QA to fully specify the roles of safety and reliability en- 
gineering as well as quality assurance personnel within the NSTS 
program, so that all critical aspects of the program and decisions 
related to the adequacy of hardware and subsystem performance 
are fully reviewed by these disciplines. 
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Issue 4 


Does the SR&QA program require improved coordination ђе- 
tween centers, contractors and NASA Headquarters? 


Findings 


1. Although guidelines have been published that describe the re- 
sponsibility of contractors in the areas of SR&QA, NASA's guide- 
lines do not adequately distinguish these various activities as dis- 
tinct disciplines requiring specialized skills and centralized coordi- 
nation. 

2. In its review of the agency's reliability and quality assurance 
programs as they relate to the Space Shuttle, the Committee found 
there was little commonality among the cognizant officials at 
MSFC, JSC, KSC, and Headquarters in the perception of the vari- 
шэн responsibilities associated with these separate and distinct dis- 
ciplines. 


Recommendations 


1. It is important that a clear delineation of responsibilities for 
the separate SR&QA disciplines be appropriately documented. It is 
also essential that the relative importance of each of the three sep- 
arate disciplines be established as an integral part of the NSTS 
program. These functions are the responsibility of NASA Head- 
quarters. 

2. NASA must carefully review the staff and resources devoted 
to the SR&QA function within NASA and contractor organizations 
for adequacy. The Administrator shall report to the Committee 
with his findings and recommendations. 


d. Contractor Incentives 


Issue 


Key Shuttle contracts (e.g., Solid Rocket Booster Production Con- 
tract and the Shuttle Processing Contract (SPC)) provide incentives 
both for reliability, integrity, and safety of products and services on 
the one hand, and for cost and schedule on the other. Do these con- 
tracts provide an appropriate balance between the two types of in- 
centives? That is, does NASA utilize contracts to reward and pro- 
mote operational safety? 

Findings 

1. The SPC provides far greater incentives to the contractor for 
minimizing costs and meeting schedules than for features related 
to safety and performance. SPC is a cost-plus, incentive/award fee 
contract. The amount of the incentive fee is based on contract costs 
(lower costs yields a larger incentive fee) and on safe and successful 
launch and recovery of the Orbiter. The award fee is designed to 
permit NASA to focus on those areas of concern which are not sen- 
sitive to the incentive fee provisions, including the safety record of 
the contractor. However, the incentive fee dwarfs the award fee— 
while the maximum value of the award fee is only one percent of 
the value of the SPC, the incentive fee could total as much as 14 
percent of the SPC. 
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2. During the developmental phases of the Thiokol contract for 
Solid Rocket Booster production (1980-1983), the contractor re- 
ceived consistent ratings of "Excellent-Plus" or "Superior" under 
the cost-plus, award-fee contract. NASA contracted with Thiokol on 
a cost-plus, incentive-fee (CPIF) basis beginning in July 1983. The 
CPIF contract pays strictly on the basis of costs, although penalties 
may be invoked for delays in delivery or for Shuttle accidents due 
to SRB failure. At the time of the Challenger accident, Thiokol was 
eligible to receive a very large incentive fee, probably on the order 
of $75 million. 


Recommendations 


1. NASA should reexamine all Shuttle contracts and report to 
the Committee with its findings and recommendations on whether 
more incentives for safety and quality can be built into these con- 
tracts. This report should address, inter alia, the SRB Production 
Contract and the SPC. 

2. NASA's new Office of SR&QA should be involved in the pro- 
curement and award fee processes, both to establish reasonable 
guidelines and rewards in new contracts and to judge performance 
of ongoing contracts. 


ГУ. BACKGROUND 


INITIAL EVENTS FOLLOWING THE ACCIDENT 


On January 28, Chairman Fuqua stated on the floor of the House 
that the Committee would conduct comprehensive hearings and 
prepare its report on the Challenger accident and its implications 
after the National Aeronautics and Space Administration had com- 
pleted its immediate investigation. NASA’s effort was to follow the 
same investigative approach it had taken after the Apollo 204! fire. 

In preparation for this time, Mr. Fuqua working with Mr. Lujan, 
the Ranking Republican Member, appointed a steering group of 
Committee Members two days following the accident to guide the 
Committee’s work. This group consisted of: 


Don Fuqua Manuel Lujan, Jr. 
Harold Volkmer Robert Walker 
Bill Nelson Ron Packard 


However, this plan and timetable were changed when President 
Reagan, by Executive Order, established a Presidential Commission 
on the Space Shuttle Challenger Accident on February 3, 1986. The 
order directed the Rogers Commission to make its final report to 
the President and the Administrator of NASA within 120 days. The 
order directed the Commission to: “(1) Review the circumstances 
surrounding the accident to establish the probable cause or causes 
of the accident; and (2) Develop recommendations for corrective or 
other action based upon the Commission’s findings and determina- 
tions.” 

With this important new development, the Committee Steering 
Group met and decided to modify its earlier approach of investigat- 
ing NASA’s inquiry to that of reviewing the Rogers Commission’s 
investigation. It was determined that the Committee’s formal work 
would begin as soon as practicable after the Rogers Commission 
issued its report. 


COMMITTEE PREPARATION 


On February 5, the Chairman, Mr. Fuqua, and Mr. Lujan, wrote 
a letter to Chairman William P. Rogers stating their support for 
the serious task which was ahead of the Presidential Commission. 
In that letter Messrs. Fuqua and Lujan also outlined the Commit- 
tee’s approach, saying: 
We would like to begin our oversight process by asking 
you to establish procedures for providing us with progress 
reports as appropriate so that we can be kept advised of 


1 Оп January 27, 1967, astronauts Virgil Grissom, Edward White II and Roger Chafee were 
killed when their Apollo spacecraft was destroyed by fire on the launch pad. 


(35) 
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the activities of your Commission. At the conclusion of the 
Commission’s work, we will undertake a thorough review 
of your report; we expect that this review will be similar 
to the review and hearings held after the Apollo 204 fire 
and the Apollo 13 incident.? 

It is our understanding that the Commission is tasked 
with completing its report in 120 days. In light of this fact, 
we would like to request your appearance before the Sci- 
ence and Technology Committee during the first week in 
June, or within one week of your final report, should you 
complete it sooner. 


The letter to Chairman Rogers also noted that a similar letter 
had been sent that same day to the NASA Acting Administrator, 
Dr. William R. Graham. It stated that the Committee also planned, 
after hearing from the Commission, to take testimony from NASA 
management on the accident, and “closely review NASA proposed 
management plans designed to implement the Commission’s recom- 
mendations.” 

Chairman Fuqua and Chairman Rogers then worked out an in- 
formal arrangement for the Committee Steering Group so that 
when there was sufficient reason to meet, in the opinion of the two 
chairmen, Chairman Rogers would brief the Steering Group on the 
progress of the investigation. 

By April 22, the Steering Group felt it had heard sufficient infor- 
mation to brief the Members of the full Committee on Science and 
Technology. This was done in a closed meeting that day. 

On May 16, 1986, Chairman Fuqua sent a memorandum to all 
Members stating that he had asked Congressman Robert Roe, the 
Ranking Majority Member, to chair the Committee hearings on the 
Challenger accident, stating that "there is a distinct possibility 
that follow-through activities related to the hearings will carry 
over into the next Congress in which I shall not serve." 


COMMITTEE TRIP 


When it appeared that the Rogers Commission would be able to 
meet its 120-day deadline, Mr. Roe arranged to take a group of 
Committee Members and key staff to the Kennedy Space Center on 
June 6, 1986. At the Center the Members heard detailed accident 
briefings, took a tour of the Vehicle Assembly Building where a set 
of Solid Rocket Motors and External Tank was examined, and 
viewed the recovered debris from the Challenger spacecraft. 


THE HEARINGS 


The Rogers Commission report was released on June 9, 1986. Im- 
mediately thereafter, the full Committee began its inquiry under 
the direction of Mr. Roe. The Committee heard from 60 witnesses 
during 10 days of hearings, for a total of 41 hours. A compilation 
follows: 


2 On April 13, 1971, Apollo 13's Command and Service Modules were disabled by an oxygen 
tank explosion en route to the Moon. The crew was recovered safely. 


Days of hearings 


June 10, 1986.......... 


June 11, 1986.......... 


June 12, 1986.......... 


June 17, 1986.......... 


June 18, 1986 1...... 


June 25, 1986.......... 
July 15, 1986........... 


July 16, 1986........... 


лый 
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CHALLENGER INVESTIGATION HEARINGS 
[Witnesses and total days of hearings] 


Witnesses 


Hon. William P. Rogers, Chairman, Presidential Commission on the Space Shuttle Challenger 
Accident. 

Neil Armstrong, Vice Chairman. 

Dr. Alton Keel, Executive Director. 

Dr. James С. Fletcher, Administrator, NASA. 

RADM Richard Truly, Associate Administrator for Space Flight, NASA, accompanied by Mr. 
Edward Aldridge, Secretary of the Air Force, Washington, DC. 

Arnold D. Aldrich, Manager, National Space Transportation System, NASA. 

Dr. William Graham, Deputy Administrator, NASA. 

Dr. Dan Germany, Leader, Photo and TV Analysis Team, NASA. 

Capt. Robert |. Crippen, Astronaut, NASA. 

Dr. James C. Fletcher, Administrator, NASA. 

Arnold D. Aldrich, Manager, National Space Transportation System, NASA. 

Mr. IS Weeks, Deputy Associate Administrator (Technical), Office of Space Flight, 
NASA. 

Dr. Milton A. Silvera, Chief Engineer, NASA. 

RADM Richard Truly, Associate Administrator for Space Flight, NASA. 

J.R. Thompson, Vice Chairman, NASA, STS 51-І Design and Data Analysis Task Force, NASA. 

Dr. William Graham, Deputy Administrator, NASA 


REPRESENTATIVES FROM NASA'S TASK TEAMS 


Dan Germany, Deputy Manager, Space Station Project Office, NASA, Johnson Space Center. 
John Thomas, Manager Ad Hoc, Solid Rocket Motor Design Team, Marshall Space Flight Center. 
Thomas J. “Jack” Lee, Deputy Director, Marshall Space Flight Center. 

Thomas Holloway, Chief, Flight Director Office, NASA, Johnson Space Flight Center. 

Thomas Utsman, Deputy Director, NASA, Kennedy Space Center. 


„. Charles $. Locke, Chairman of the Board and Chief Executive Officer, Morton Thiokole. 


Joseph С. Kilminster, Vice President, Space Operations, Morton Thiokol. 

Allan J. McDonald, Director, SRM Verification Task Force, Morton Thiokol. 

Roger M. Boisjoly, Staff Engineer, Morton Thiokol. 

U. Edwin Garrison, President, Aerospace Group, Morton Thiokol. 

Carver G. Kennedy, Vice President, Space Booster Programs, Morton Thiokol. 

Arnold R. Thompson, Supervisor, Structures Design, Morton Thiokol. 

Dr. William Graham, Deputy Administrator, NASA, accompanied by Thomas Moser, Deputy 
Administrator, Office of Space Flight, NASA. 

RADM Richard Truly, Associate Administrator for Space Flight, NASA. 

Dr. William Lucas, Director, Marshall Space Flight Center, accompanied by J. Wayne Littles, 
Deputy Director of Science and Engineering, Marshal! Space Flight Center. 

Lawrence Mulloy, Assistant to the Director for Science and Engineering, Marshal! Space Flight 
Center. 

Gerald W. Smith, Manager, Solid Rocket Booster Project, Marshall Space Flight Center. 

Stanley Reinartz (no comment), Manager, Special Projects Office, Marshall Space Flight Center. 

William Sneed, Assistant Director, Policy and Review, Marshall Space Flight Center. 

U. Edwin Garrison, President, Aerospace Group, Morton Thioko!. 

Joseph C. Kilminster, Vice President, Morton Thiokol. 

Carver G. Kennedy, Vice President, Space Booster Program, Morton Thiokol. 

Allan J. McDonald, Director, SRM Verification Task Force, Morton Thiokol. 

Roger M. Boisjoly Staff Engineer, Morton Thiokol. 

Arnold 8. Thompson, Supervisor, Structures Design, Morton Thiokol. 


... Maj. Donald “Deke” К. Slayton, Brig. Gen. James А. McDivitt, Capt. John W. Young, Col. Henry 


W. Hartsfield, Jr., Comdr. Robert L. Gibson, Gen. Thomas Stafford. 

George Jeffs, President, North American Space Operations, Rockwell International. 

Richard M. Davis, President, Martin Marietta Michoud Aerospace. 

George Murphy, Executive Vice President and General Manager, United Technology Booster 
Production Co. 

E.D. Sargent, President, Lockhaed Space Operations Co. and Program Manager, Shuttle 
Processing Contract, accompanied by Fred Haise, President, Grumman Technical Services 
Division. 

Carver Kennedy, Vice President, Space Booster Programs, Morton Thiokol. 

David Owen, Lockheed Space Operations Co. and Deputy Program Manager, Kennedy Space 
Center. 


Days of hearings 


July 23, 1986........... 


July 24, 1986........... 
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CHALLENGER INVESTIGATION HEARINGS—Continued 


Total 


witnesses 


(Witnesses and total days of hearings] 


Witnesses 


Charlie Floyd, Systems Engineer, Lockheed Space Operations Co. 

James R. Dubay, President and General Manager, EG&G Florida, Inc., accompanied by Dr. 
Donald Kerr, Senior Vice President, EG&G Florida, Inc. 

George R. Faenza, Vice President and General Manager, McDonnel! Douglas Astronautics Co. 


„. Alan М. Lovelace, Vice President and General Manager, Space Systems Division, General 


Dynamics Corp. 
John Е. Yardley, President, McDonnell Douglas Astronautics Co. 


.. Lt. Gen. James A. Abrahamson, Director, Strategic Defense Initiative, Department of Defense. 


Jesse W. Moore, Director, Johnson Space Center, NASA/Houston, Texas. 
Robert F. Thompson, Vice President, Space Stations, McDonnell Douglas Astronautics Co. 
G.S. Lunney, President, Satellite Systems Division, Rockwell International. 


Arnold Aldrich, Manager, National Space Transportation System, Lyndon B. Johnson Space 
Center, NASA/Houston, Texas. 


ї Continued from June 17, Morton Thiokol only. 


У. THE ACCIDENT 


A. INTRODUCTION 


This section as well as Sections VII and VIII identify what hap- 
pened, as well as what did not happen, to cause the loss of the 
Challenger. This section also discusses why the accident happened 
in an effort to prevent future catastrophes. 

By the time the Rogers Commission had completed its report, it 
had been learned that many items investigated by the Commission 
did not contribute to the accident. Consequently, this section is di- 
rected toward a more narrow range of possible contributing causes. 

There were human as well as technical failings that combined on 
the morning of January 28, 1986, to cause the Challenger accident. 
Most of NASA’s personnel were not involved in the Solid Rocket 
Motor program while there were others outside of NASA, such as 
the media, the Congress and the Administration, who were in- 
volved through their influence on the Shuttle program. 

It should also be recognized that this report has the advantage of 
hindsight. Our investigation indicates that the decision to launch 
Challenger on January 28 suffered equally from a lack of informa- 
tion, misinterpretation of the information that was available, and a 
complex interplay of personalities among the principals involved. 
We are equally convinced, however, that the resulting decision to 
launch was arrived at as a logical conclusion of faulty premises, 
— with а failure to recognize the effect of temperature on the 

esign. 

We hope the lessons learned from this accident will lead to 
design improvements in the Shuttle Program. Just a few years ago, 
the collapse of the Hartford Civic Center contributed to the im- 
provement of engineering design techniques to accommodate the 
unique secondary forces inherent in long-span structures. The 
Gothic cathedrals of the fourteenth century were constantly im- 
proved after their early failures were studied. 

We hope this section, as well as Sections УП and VIII, properly 
identify the mistakes that led to the Challenger accident. It is the 
intent of the Committee to identify these mistakes so that NASA 
will regain its former level of excellence. The Committee has confi- 
dence that the men and women of the Naticeal Aeronautics and 
Space Administration will meet the challenge, improve the Shuttle 
and their management methods, and go on to explore new frontiers 
in space. This assumes, however, that the agency will now receive 
resources adequate to support the programs it is authorized to 
carry out by the Congress and the President. 


(39) 
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For the benefit of those who may not be familiar with the Space 
Transportation System, the Shuttle consists of an Orbiter (51-L’s 
Orbiter, the Challenger, was one of a four-vehicle fleet), an Exter- 
nal Tank (ET), and two Solid Rocket Boosters (SRBs). (See Figure 
V-1.) A brief description of the Solid Rocket Booster and the Solid 
Rocket Motors is included to familiarize readers with these sys- 


tems. 
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The Solid Rocket Boosters operate in parallel with the шаш еп- 
gines for the first two minutes of flight to provide the additional 
thrust needed if the Orbiter is to escape the gravitational pull of 
the Earth. At an altitude of approximately 144,000 feet (24 nautical 
miles), the SRBs separate from the Orbiter/External Tank, descend 
on parachutes, and land in the Atlantic Ocean. They are recovered 
by ships, returned to land, and refurbished for reuse. 

The heart of the booster is the Solid Rocket Motor (Figure V-2). 
It is the largest solid propellant motor ever developed for space 
flight and the first built to be used on a manned craft. Larger solid 
motors have been test-fired but have never been carried through 
complete development to actual use in flight. The huge Solid 
Rocket Motor is composed of a segmented motor case loaded with 
solid propellant, an ignition system, a movable nozzle, and the nec- 
essary instrumentation and integration hardware. 
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Each motor case із made of 11 individual weld-free steel seg- 
ments (Figure V-3). Averaging approximately 1.27 centimeters (0.5 
inch) thick, the steel is a high-strength formulation. Each segment 
is heat-treated, hardened, and machined to the exact dimensions 
required. The 11 segments are held together by 177 high-strength 
steel pins at each case segment joint. The clevis-type joints are 
wrapped with reinforced fiberglass tape and sealed with a rubber 
seal band that is bonded to the case with adhesives. 
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FIGURE У-3 


In this report there are many references to the joint design, ero- 
sion and O-ring seals. There are several different joint designs used 
in the Solid Rocket Motor. The joint that failed on the last Chal- 
lenger flight, the aft field joint, was not the one that had been 
giving NASA the most trouble. More O-ring erosion had been expe- 
rienced on nozzle joints, the design of which is significantly differ- 
ent than the aft field joint. However, since NASA treated erosion 
as a problem that impacted both the nozzle and field joints, the 
data on erosion in this section includes that obtained from the 
nozzle joint. 

Whenever a temperature is specified, it is essential that it be re- 
lated to a specific medium such as air (or ambient temperature), 
rocket propellant, or casing joints, for example. The temperature of 
the joints, air and propellant can all be different at the same time, 
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just as the ocean temperature at the beach on а 90-degree day 
could be 75 degrees. 

Much of this discussion concerns heat, or the absence thereof. 
For example, if an O-ring had given up heat during the night, it 
would very likely be at a lower temperature than the temperature 
of the air in the morning after the sun had risen. This was the situ- 
ation at the time Flight 51-L was launched. The heat gained by the 
joint in the time after sunrise was not sufficient to raise the tem- 
perature of the O-ring material to a level where Thiokol engineers 
believed the O-ring could respond and seal the joint under ignition 
pressures. 

The following chart describes the principal steps in the evolution, 
flight, and reconditioning of the Solid Rocket Motors (Figure V-4). 
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Because ої the difficulty the reader may find іп understanding 
the NASA Flight Readiness Review for the Solid Rocket Booster 
for Flight 51-L and the terms used to describe the steps in the 
process, the following chart describes the level of review, office con- 
ducting the review, and the scope of the review. In addition to the 
following meeting chart, there were numerous other ad hoc meet- 
ings on the SRMs including the meeting between NASA and Thio- 
kol personnel during the evening before the launch of Flight 51-L. 


TABLE |.—FLIGHT READINESS REVIEWS 


(875-51) 
Level and date Reviewing office Scope of review 

М—Рес. 11, 1985.................. Thiokol Wasatch...................... Conducted by Thiokol Solid Rocket Motor program managers in 
preparation for presentations to Marshall Space Flight Center 
(MSFC). 

МІ- ес. 17, 1985.................. SRM Ойсе............................... Conducted by Larry Wear, Manager of the Solid Rocket Motor 
Program Office, MSFC. Material presented by Thiokol personnel. 

Ij — Jan. 3, 1986..................... SRB Project Office ................... Conducted by Larry Mulloy, Manager of the Solid Rocket Booster 


Project Office. This is a combined briefing on the SRM and the 
elements making up the booster assembly, which, when 
integrated make up the Shuttle 5010 Rocket Boosters, 

||---Јап. 9, 1986..................... Shuttle Ргоўесі5........................ Conducted by Stanley Reinartz, Manager, Space Shuttle Projects 
Office, MSFC. This review discusses all elements of the Shuttle 
managed by Marshall. 

I] —Jan. 13, 1986................... Center Board............................ Conducted by Dr. William Lucas, MSFC Director. Final discussion 
of Marshall hardware in preparation for review by the Space 
Transportation System Program Manager. 

|—Јап, 14, 1986.................... STS Program ............................ Conducted by Arnold Aldrich, Space Transportation System Pro- 
gram Manager. First review dealing with the flight vehicle and 
associated ground support in its entirety. 

I—Jan 15, 1986...................... Space Flight ........................... Conducted by Jesse Moore, Associated Administrator for Space 
Flight. Remaining items that impact launch are discussed and 
assigned for disposition. Certificate of Flight Readiness is 
signed. 

|--Јап. 25, 1986..................... 1-1 Веміем............................. Meeting of the Mission Management Team to receive reports on 
action items remaining from the Flight Readiness Review. All 
action items should be closed by this time. 


Considerable reference will be made to the "joint design" 
throughout this section of the report. Consequently, the following 
description of the joint is provided. (See Figures V-5 thru V-7.) 
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В. Зою Rocket MOTORS 


1. HISTORY 


Issue 


Was there sufficient time to correct the problems with the Solid 
Rocket Motor? 


Findings 


1. Problems with the joints which connect the Solid Rocket 
Motor casings were recognized for many years. While attempts 
were made to correct these problems, the measures taken were in- 
sufficient to provide a reliable joint. 

2. The joint seal problem was recognized by engineers in both 
NASA and Morton Thiokol in sufficient time to have been correct- 
ed by redesigning and manufacturing new joints before the acci- 
dent on January 28, 1986. Meeting flight schedules and cutting cost 
were given a higher priority than flight safety. 


Discussion 


At seven different times in the Shuttle Program, NASA and 
Thiokol managers made poor technical decisions that ultimately 
permitted continued flight of an unsafe Solid Rocket Motor design. 

1. NASA’s issuing of a performance specification that did not 
adequately take into account the known weather conditions that 
occur in Florida during the winter months. 

2. Accepting the new joint design without sufficient certification 
and testing. 

3. Failure to accept John Miller’s 1 recommendations to redesign 
the clevis joint on all on-coming hardware at the earliest date. 

4. Establishing a specific value for the upper limit of erosion 
that could be tolerated in flight on the basis of a "computer pro- 
gram mode!" instead of recognizing the erosion itself as a failure of 
the joint. 

5. Proceeding through more than four years of Shuttle flights 
with continuing joint/seal problems without designing, testing and 
incorporating a new type of field joint and nozzle joint as well. 

6. NASA's permitting Thiokol to continue making Solid Rocket 
Motors without conducting full scale tests as had been requested by 
NASA 14 months previously. 

1. Mr. Mulloy's description of joint failures as being within 
"their experience base." In other words, if it broke before and the 
size of the recent break was no bigger than those before, then there 
was no problem. Even when the erosion surpassed all previous ex- 
perience, NASA then went on and expanded its "experience base." 

What follows is a list of events and documents which relate to 
the cause of the accident. They are included here to demonstrate 
that there was adequate experience and information available 
before the accident and that this information should have been suf- 
ficient to cause the initiation of corrective action before the Jaunch 


of Flight 51-L. 


! John Q. Miller is Chief, Solid Motor Branch, Marshall Space Flight Center, NASA. 
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July 16, 1973.—NASA issues a Request for Proposal (RFP) for the 
Space Shuttle Solid Rocket Motor project. Under “Scope of Propos- 
al,” the RFP stated in part: 


NASA considers that a prime contractor’s use of estab- 
lished expertise in the private sector is an essential ap- 
proach toward the objective of maximum economic effec- 
tiveness. Proposals from joint ventures will not be accept- 
ed, and the development of new expertise by a prime con- 
tractor, either in-house or elsewhere in the private sector, 
is to be avoided to the extent possible, since the latter 
course detracts from the stated objective. 

This RFP is specifically directed toward the design, de- 
velopment, test, production, acceptance, operation, and re- 
furbishment of the Solid Rocket Motor and its ancillary 
equipment, post-flight analysis, and support functions. It is 
imperative in all considerations of the proposal and its 
subsequent implementation, that effort be made to mini- 
mize production and operating costs while maintaining 
reasonable DDT&E costs. The minimization of these costs 
entails the utilization of design and production approaches 
that will result in the lowest possible cost per flight con- 
sistent with the Space Shuttle Program early year funding 
constraints and the design, performance and reliability 
requirements. !* 


August 27, 1973.—Thiokol, in the Executive Summary to its re- 
sponse to the RFP, addressed NASA concerns regarding SRM reli- 
ability (Appendix М, RFP 8-1-4-94-98401). Among other failure 
modes identified by NASA, Thiokol described the steps it had 
taken to prevent O-ring seal failure. These included: 


DESIGN FEATURES 


Redundant seals; 
Protection of mating surfaces; 
Assure proper environment and capability. 


TEST AND CONTROL FEATURES 


Functional leak check of dual seals prior to test or use; 

Material | migration/compatibility tests ќо demonstrate 
suitability.” 

November 19, 1973.—In its report to NASA Administrator James 
C. Fletcher, the Solid Rocket Motor Source Evaluation Board (SEB) 
evaluated the proposals generated by the Solid Rocket Motor RFP. 
Thiokol scored 124 out of a possible 200 points for its motor design, 
the lowest score among the four competitors. The only design 
strength identified by the Board: “Саве joint leakcheck capability 
increases reliability and improves checkout operations." 15 


^ NASA, Marshall Space Flight Center, "Request for Proposal: Space Shuttle Program Solid 
Rock Motor Project," RFP 8-1-4-94-98401, Volume 1, July 16, 1973, pp. 1-3, 1-4. 

» Thiokol, “Executive Summary: Pro 1 for Solid Rocket Motor Project for the Space Shut- 
tle Program,” Publications No. 0873-73270-1, Volume 1, August 27, 1973, p. 3-10 (Table 3-4). 

с NASA, Marshall Space Shuttle Center, "Presentation to NASA Administrator: Solid Rocket 
Motor Project Source Evaluation Board," RFP 8-1-4-94-98401, November 19, 1973, Chart D-4. 
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November 1978. —Тће SEB Design, Development and Verification 
Team Report rejected proposals by Aerojet and United Technol- 
ogies Corporation to test motor performance at 40° and 90° Fahren- 
heit. The report stated that “The temperature conditioning of two 
motors to verify the motor performance over the range of 40° to 90° 
is not required, as this data can be obtained from the normal varia- 
tion in ambient conditions." 14 

December 12, 1973.—N ASA Administrator James C. Fletcher ar- 
nounced selection of Morton Thiokol as contractor for Design, De- 
velopment, Test and Evaluation (DDT&E) of the Solid Rocket 
Motors. In the source selection statement, “Selection of Contractor 
for Space Shuttle Program, Solid Rocket Motors," a statement was 
included that indicates that Thiokol ranked fourth out of the four 
bidders in the design category (See Appendix V-A). NASA, howev- 
er, placed greater importance on cost reduction and Thiokol had an 
attractive cost proposal.? 

January 9, 1978.—Major problems with the joint design were 
identified when Mr. John Miller of NASA sent a memo to Mr. 
Eudy. In it Miller stated, “Calculations performed by MSFC [Mar- 
shall Space Flight Center personnel] and agreed to by Thiokol show 
that distortion of the clevis joint tang for any joint can be suffi- 
cient to cause O-ring/tang separation. Data from DMT-1 [Develop- 
ment Motor Test-1] showed that this condition could be created by 
joint movement . . ." Miller continued, “АП situations which could 
create tang distortion are not known, nor is the magnitude of 
movement known." Miller also noted that 15 percent industry rec- 
ommended a compression value of 15 percent for adequate O-ring 
performance. He also cited a Thiokol test report dated August 15, 
1977, TWR-11507, which showed a maximum compression of 5.8 to 
1.0 percent for O-ring material and spliced joints. Finally, Miller 
also recommended a redesign of clevis joints on all on-coming hard- 
ware at the earliest possible effectivity to preclude unacceptable, 
high risk, O-ring compression values. 

November 7, 1978.—Ten months later it would appear that there 
was nothing to worry about when a letter from Е. С. Dorsey of 
Thiokol to Mr. George Hardy of MSFC contained the statement, 
“The extrusion data presented in the review and mentioned in the 
minutes have confirmed the capability of the O-rings to prevent 
leakage under the worst hardware conditions.” Mr. Dorsey at- 
tached the Thiokol TWR-12019, dated October 6, 1978 to his letter. 

February 2, 1979.—Mr. Eudy and Mr. Ray of NASA visited the 
Parker Seal Company. A trip report. was sent to Messrs. Hardy/ 
Rice/McCool of NASA which contained the following statement: 
“Parker experts would make no official statements concerning reli- 
ability and potential risk factors associated with the present design 
however, their first thought was that the O-ring was being asked to 
perform beyond its intended design and that a different type of seal 
should be considered. The need for additional testing of the present 
design was also discussed and it was agreed that tests which more 


а NASA, Marshall Space Flight Center, "Design, Development and Verification Team Report: 
Solid Rocket Motor Project," November 1978, p. 50. . 

? NASA, "Selection of Contractor for Space Shuttle Program, Solid Rocket Motors," January 
2, 1974. 
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closely simulated actual conditions should be done.” This report 
also referred to the O-ring extrusion gap being larger than Parker 
had previously experienced. (See Appendix V-I.) 

November 12, 1981.—During STS-2, the second Shuttle flight, 
erosion of the primary O-ring was discovered in the 90 degree loca- 
tion of the aft field joint of the right hand Solid Rocket Motor. The 
0.058 inch erosion was not discussed in the STS-3 Flight Readiness 
Reviews.? This was the deepest O-ring erosion that would be discov- 
ered in any case field joint. 

February 25, 1983.—Employees of Thiokol discussed joint "gap 
size" and “O-ring compression" at a briefing at the Marshall Space 
Flight Center (MSFC).4 

March 17, 1983.—Mr. Lawrence Mulloy, MSFC Solid Rocket 
Booster (SRB) Project Manager, informed NASA Level 1 (meaning 
the Associate Administrator for Space Flight) of the pending 
change in criticality from 1R to 1, which meant that a single seal 
failure could result in the loss of the Shuttle and crew. That 
change was approved on March 28, 1983.5 

April 4, 1983. —STS-6 was the first flight to use the “lightweight 
case." It was also the first flight where a criticality factor of 1, in- 
stead of ІК, was assigned to the joint. After the flight, “blowholes” 
in the nozzle to case joints, not the case field joints, were found in 
both the left and right Solid Rocket Motors. These observations 
were not discussed іп the Flight Readiness Reviews for STS-7.® 

December 6, 1983.—An internal Marshall Space Flight Center 
(MSFC) memo from Mr. Miller to Mr. Horton highlighted the seal 
— detection and zinc chromate putty problems. (See Appendix 

-D.) 

February 22, 1984.—Marshall Space Flight Center memorandum 
from Ben Powers to Horton requested that post-flight апа post- 
static firing inspection on specific joints be made. The memo ex- 
pressed concern about adhesion life of the zinc chromate sealant 
after installation on the SRM. See Appendix V-F. 

March 2, 1984.—Thiokol personnel described the erosion discov- 
ered in the 351 degree location of the left Solid Rocket Motor for- 
ward field joint of STS-41B at a Flight Readiness Review. The ero- 
sion extended over three inches with a maximum depth of 0.040 
inches. This was the first time the subject of O-ring erosion sus- 
tained on flights STS-2 and STS-6 was discussed as a technical 
issue at a Flight Readiness Review.’ 

March 8, 1984.—The notion of ACCEPTABLE EROSION was 
mentioned at a meeting of the Shuttle Projects Office Board for 
STS-41-C. Even though the joint was now classified as Criticality 
1, which meant that failure of the joint could lead to the loss of the 
Shuttle and crew, the concept of "maximum possible" erosion, 
0.090 inches, was accepted as an absolute value based on a comput- 


3 Thiokol Report, TWR-300209, Brian Russell, "Narrative History of SRM Seal Erosion and 
Blowby Incidents," June 25, 1986, p. 3. 

4 — Commission Report, Volume II, р. Н-1. 

5 Ibid. 

8 Ibid. [NoTE.—The nozzle to case joint design is significantly different than the case field joint 
design which caused the Challenger accident. However, it is cited here because some of the prob- 
lems a relevant to the failure of the aft field joint.] 

Ibid. 
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er program which was supported by limited data. Furthermore, the 
0.090 inch value was based on the concept that the O-ring would 
seal at 3 times the actual motor pressure even if the erosion ex- 
tended to 0.095 inches thereby giving comfort in continuing with a 
known problem.® 

March 1984.—Thiokol submitted their “Performance Charateris- 
tics of the SRM O-ring Assembly Test Plan,’ TWR-14336, which 
contained the following statement: “O-ring seals in rocket motors 
in general and the Space Shuttle SRMs in particular can suffer 
thermal degradation because of exposure to the high temperature 
motor chamber gases. Although none of the SRM primary O-rings 
to date have failed to perform their design function, there is some 
concern because of isolated events which show localized erosion as 
high as 0.053 inches. The postulated scenario for this thermal deg- 
radation effect is a short time duration impingement of a high 
energy jet which is induced during ignition pressurization by a 
combination of voids in the protective vacuum putty and the filling 
of available free volumes created by the tolerances of mating parts 
and the O-ring 81018.” 

March 20, 1984.--Ассеріабіе erosion was again discussed at the 
Flight Readiness Review briefing to the Marshall Center Воага.? 

March 27, 1984.—Mr. Mulloy discussed O-ring erosion at the 
Level 1 Flight Readiness Review for STS41-C. As a result, he re- 
ceived an “action item” to review the case and nozzle seals. The 
action did not have to be completed before the flight of STS41-C.!9 

Mr. Lawrence Wear, the Solid Rocket Motor (SRM) Element 
Manager, then directed Thiokol to establish a plan and a test pro- 
gram to investigate the issue. Thiokol was directed to determine if 
the O-ring erosion was acceptable and if so, why??? 

April 6, 1984.—Heat degradation of the O-ring in the left SRM 
aft field joint of STS41-C was found, along with "blowholes" in the 
putty. 

April 12, 1984.—In an internal Marshall Space Flight Center 
memorandum, John Q. Miller told Mr. Horton that "stacking diffi- 
culties and observed O-ring anomalies" were increasing with the 
use of Randolph putty. The former supplier, Fuller O'Brien, had 
discontinued producing the putty previously used in the Shuttle 
program. Accordingly, putty was ordered from Randolph Products. 
The memo requested expedited development of a putty with the 
characteristics of the Fuller O'Brien putty used prior to STS-8. 

May 4, 1984.—Morton Thiokol prepared a Program Plan for the 
protection of Space Shuttle SRM primary motor seals. Thiokol's ob- 
jective was to isolate the joint problem and to eliminate damage to 
the motor seals, the O-rings. The plan called for analysis and test- 
ing of O-rings, putty and associated lubricants.!? See Appendix 
V-B. 


8 Tbid. 

? Ibid. 

10 Thid. 

11 Thid. 

12 Morton Thiokol, “Program Plan, Protection of Space Shuttle SRM Primary Seals," TWR- 
14359, May 4, 1984. 
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May 23, 1984.—NASA responds to Thiokol’s plan, endorsing the 
Program Plan, supplementing it and expressing continued concerns 
about zinc chromate putty performance.!? See Appendix У-С. 

May 30, 1984.—A presentation by Thiokol personnel at the SRM 
Preboard Flight Readiness for STS41-D described the problems 
with STS41-C.'* 

June 8, 1984.—The Marshall Center Board review for STS41-D 
took place without mention of the SRM problems found on 
STS41-C, even though Thiokol had prepared briefing charts for the 
review. 

June 18, 1984. —MSFC memorandum from Miller to Horton men- 
tioned zinc chromate putty installation discrepancies and recalled 
eroded/heat exposure O-ring experiences on QM-4, STS-2, STS-6, 
STS-11 (418) and STS-13 (410). 

June 18, 1984.—The Level 1 Flight Readiness Review for 
STS41-D took place, but again without mention of the O-ring prob- 
lems discovered on STS41-C. 

June 29, 1984.—Scenario of hot gas jet impingement against O- 
ыга J substantiated іп a teleconference between Thiokol and 


August 30, 1984.—STS41-D was launched. Upon disassembly of 
the SRM casings at the Kennedy Space Center (KSC). O-ring ero- 
sion was found in both the right-hand forward field joint and the 
left-hand nozzle joint. The field joint erosion was 0.028 inches deep 
and extended over а 3 inch span іп the 275 degree location. 18 

September 12, 1984.—Thiokol personnel discussed the problems 
with STS41-D at the STS41-G SRM Preboard Review." 

September 19, 1984.—For the first time, at the STS41-G Shuttle 
Projects Board review, Mr. Mulloy mentioned the term “allowable 
erosion.” He used the same briefing charts on September 20 at the 
Marshall Center Board Review. 18 

Flights 51541-С and STS51-A successfully flew without O-ring 
damage, a fact that was mentioned in the SRM Preboards for 
STS51-A and 5Т551-сС.'? 

January 24, 1985.—With a calculated O-ring temperature of 53 
degrees F, STS51-C suffered erosion and blow-by in the two case 
field joints. The primary O-ring in the left-hand forward field joint 
was eroded 0.010 inches over a span of 4.25 inches at the 163 
degree location, with a considerable amount of soot between the 
primary and secondary O-rings. The primary O-ring in the right- 
hand center field joint was eroded 0.038 inches over a 12.5 inch 
space at the 354 degree location. There was soot behind the pri- 
mary O-ring over a 110 degree arc and the secondary O-ring was 
heat damaged over a span of 29.5 inches. 

January 91, 1985.—At the STS51-E Preboard review, Thiokol 
personnel described the previous O-ring damage in detail as well as 


13 NASA, letter from John Miller, MSFC, “Evaluation of TWR-14359, ‘Program Plan, Protec- 
tion of Space, Shuttle SRM Primary Motor Seals,' " EP 25 (84-49), May 23, 1984. 

'* Rogers Commission Report, Volume II, p. H-1. 

15 Ibid. 

16 Ibid. 

1714. p. H-2. 

18 Ibid. 

19 Ihid. 
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joint performance. They also showed analytical predictions of the 
"maximum expected erosion.” 20 

February 12, 1985.—Mr. Mulloy and Thiokol personnel presented 
a summary of STS 51-C O-ring related problems during a briefing 
to the Shuttle Projects Office Board. A portion of the problem sum- 
mary on the briefing charts referred to a field joint O-ring blow-by 
problem as being an “acceptable risk.” In this briefing the second- 
ary O-ring was referred to as a “redundant seal using actual hard- 
ware dimensions” even though the field joint had been officially 
classified as Criticality 1 for two years.?! 

February 14, 1985.—Mr. Mulloy addressed the Marshall Center 
вака but did not comment on the STS 51-С O-ring problems іп 

etail.?? 

March ?, 1985.—MSFC Memo to Mr. Mulloy from Mr. McCool. 
McCool was concerned that 14 months had elapsed since full scale 
diameter tests to provide data on zinc chromate putty behavior as 
it related to its effect on joint leak checks were requested. McCool 
pointed out that the only positive response from Thiokol was the 
Program Plan submitted on May 4, 1983.?? (See Appendix V-E.) 

April 4, 1985.—A letter from MSFC to Mr. Joseph Kilminster of 
Morton Thiokol requested specific sub-scale and full-scale tests on 
effects of zinc chromate putties on O-ring sealing integrity. 

April 12, 1985. —STS 51-0 was launched and, upon disassembly, 
erosion of the primary O-rings in both nozzle joints was discovered. 
The right-hand nozzle primary O-ring eroded to a depth of 0.068 
inches over a 6 inch span at the 116 degree location. The left-hand 
nozzle primary O-ring eroded to a depth of 0.011 inches over a 2.12 
inch span at the 14 degree location. There was no blow-by past 
either nozzle O-ring. 

April 17, 1985.—' The Shuttle Projects Board for STS 51-B was 
held without mention of seal problems. There was also no mention 
of seal problems associated with STS 51-C or 51-D at the Level 1 
Flight Readiness Review on April 23, 1985.?* 

April 22, 1985.—Thiokol’s evaluation of a second source for putty 
is issued. The evaluation states: “Тһе Randolph Products putty is 
the only material presently qualified for use on the Space Shuttle 
Program. It is the desire of Morton Thiokol to evaluate and qualify 
a second source for a joint filler material." The evaluation went on 
to state, "The material has demonstrated poor processing charac- 
teristics and is moisture sensitive." 25 

April 24, 1985.—Problem Assessment System Record Number 
A07934, tracking damage to the field joint seals, contains the fol- 
lowing entry: “At NASA request, a solution for O-ring erosion will 
not involve a radical design change. Therefore, the possible solu- 
tions under current investigation are linked to: (1) new O-ring [ma- 


22 і Ч 

23 NASA, MSFC, Memo from Mr. Alex McCool, “Request for Initiation of Testing to Provide 
Data for Resolving the Burned O-Ring Seal Problem оп the Space Shuttle SRM,” ЕРОЇ (85-48), 
March 7, 1985. 

24 Rogers Commission Report, Volume Н, р. H-2. | | | 

25 Thiokol, S.H. Cardall, "SRM Evaluation of Second Source Joint Filler Material," TWR- 
14946, April 22, 1985, pp. 1-2. 
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terials] and/or diameter and (2) new vacuum putty and/or layup 
procedure. 

April 29, 1985.—Flight STS 51-B was launched and when the 
Solid Rocket Boosters were recovered, it was found that the worst 
O-ring erosion to date had occurred. The left-hand nozzle primary 
O-ring eroded to a depth of 0.171 inches over a 1.50 inch space at 
the 54 degree location. There was evidence of considerable blow-by. 
The secondary O-ring was eroded to a depth of 0.032 inches over a 
3 inch span which was also at the 54 degree sector. The right-hand 
nozzle O-ring eroded to a depth of 0.005 inches over a 3.50 inch 
span at the 14 degree location. 

May 8, 1985.—Blowholes through the putty in one field joint 
from each of the STS 51-B SRMs was mentioned before the SRB 
Board for Flights STS 51-F and STS-51-G. 

May 29, 1985.—The STS 51-G Shuttle Project Board took place 
without mentioning O-ring problems.?® 

May 13, 1985.—The Center Board Review for STS 51-G took 
place without mentioning O-ring problems.?? 

June 11, 1985.—The Level 1 Flight Readiness Review for STS 51- 
С took place without mentioning O-ring problems.?? 

June 17, 1985.—STS 51-G was launched, experiencing blow-by 
and erosion in both nozzle joints. The right-hand nozzle primary O- 
ring was eroded in two different places. The left-hand nozzle pri- 
mary O-ring was also eroded and there was blow-by associated with 
all three locations. 

July 1, 1985.—A combined Flight Readiness Review for the Mar- 
shall SRM Preboard, SRB Board, Shuttle Project Office Board, and 
Marshall Center Board was held at which Thiokol personnel pre- 
sented an extensive analyses of the problems discovered on Flight 
STS 51-B.?? 

July 2, 1985.—Mr. Mulloy briefed the Level I Flight Readiness 
Review for STS 51-F and presented the STS 51-B O-ring erosion 
problem as a “closed item." Mr. Mulloy based this resolution on 
the use of a higher 200 psi leak check stabilization pressure and 
introduced, for the first time, a rationale for accepting secondary 
O-ring erosion. The Roger Commission would not find any refer- 
ence to O-ring problems in any Flight Readiness Review associated 
with Flight STS 51-D or STS 51-G.?° 

July 19, 1985.—An attempt to form an SRM Erosion team at 
Thiokol "virtually failed" according to Mr. Roger М. Boisjoly be- 
cause of lack of commitment on the part of Thiokol personnel. 

July 22, 1985.—One of the engineers who appreciated the joint 
problem was Mr. Boisjoly of Morton Thiokol. In a “Progress 
Report” he wrote, “This problems has escalated so badly in the 
eyes of everyone, especially our customer, NASA, that NASA has 
gone to our competitors on a proprietary basis and solicited their 
experiences on their joint configuration.”*! (See Appendix V-G.) 


26 Ibid. 

27 Ibid. 

28 [bid. 

29 Ты. 

зо Ibid., p. H-3. 

31 Thiokol, Roger Boisjoly, “Progress Report: Applied Mechanics Center,” July 22, 1985. 
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July 29, 1985.—STS 51-Е was launched without O-ring erosion 
problems. However, there was a blowhole through the putty in the 
аа SRM nozzle and the primary O-ring was affected by 

eat. 

July 31, 1985.—Boisjoly wrote an interoffice memo to R.K. Lund, 
Morton-Thiokol’s Vice President of Engineering: On it, he warned 
that the rationale for flying the joint design was now suspect as a 
о the secondary O-ring erosion on STS 51-В.?* See Appen- 

ix V-J.). 

August 7, 1985.—The Shuttle project review for STS 51-I was 
conducted, followed on August 18 by the Marshall Center Board 
and on August 15 by the Level 1 Flight Readiness Review. The O- 
ring damage was noted at these reviews. 

August 19, 1985.—Thiokol gave a presentation to Mr. Weeks, 
NASA Deputy Associate Administrator for Flight (Technical), and 
— at NASA Headquarters, which contained the following 
chart. 


SUMMARY OF SIGNIFICANT OBSERVATIONS 


All joints: 
Seal damage always has associated putty blowhole 
Putty blowholes exist without resultant seal damage 
Soot blowby can occur away from a putty blowhole 
Frequency of O-ring damage has increased since incorporation of: 
Randolph putty; 
Higher stabilization pressures in leak test procedure; 
High performance motors. 
Randoph putty is more susceptible to environmental conditions such as humidi- 
ty and temperature. 
Can become leathery in dry conditions; 
Becomes extremely sticky in moist conditions and in some cases begins to 
disintegrate.?? 

August 20, 1985. А Thiokol interoffice memo mentioned that a 
Nozzle O-ring Investigation Task Force had been formally institut- 
ed, stating, “Аз you are aware, we have experienced O-ring damage 
on a random basis in the case field joints and prevalently in the 
case/nozzle joint on the Space Shuttle Booster Motors. The fre- 
quency had increased in recent flights. While we have not compro- 
mised the performance of any motor to date, the result of a leak at 
any of the joints would be catastrophic." JEN 

August 27, 1985. Flight STS 51-I was launched, after which it 
was discovered that there was primary O-ring erosion in two loca- 
tions on the left-hand SRM nozzle joint. At the reviews for STS 51- 
J, which occurred on September 9, 1985, September 17, 1985, Sep- 
tember 19, 1985, and September 26, 1985, the O-ring erosion noted 
on STS 51-I was merely itemized as, "left-hand nozzle to case pri- 
mary O-ring erosion within experience base." There was no O-ring 
damage on Flight STS 51-J. 

August 40, 1985. One year and four months after the original 
drafting of Thiokol's Program Plan TWR-14359, for improvement 
of Space Shuttle SRM Motor Seals, the revised version of the plan 
was issued. 


за Thiokol, Roger Boisjoly, "SRM O-Ring Erosion/Potential Failure Criticality," Memo 2870: 
FY 86: 073, July 31, 1985. 
3? Rogers Commission Report, Volume II, p. H-73. 
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October 1, 1985. R.V. Ebeling of Morton Thiokol submitted а 
weekly activities report to A.J. McDonald, Director, Solid Rocket 
Motor Project, with copies to J. Kilminster and others, which in- 
cluded the following statements: 


Executive Summary. HELP! The seal task force is con- 
stantly being delayed by every possible means. People are 
quoting policy and systems without work-around. MSFC is 
correct in stating that we do not know how to run a devel- 
opment program. 


* * * * * 


5. The allegiance to the O-ring investigation task force 
is very limited to a group of engineers numbering 8-10. 
Our assigned people in manufacturing and quality have 
the desire, but are encumbered with other significant 
work. Others in manufacturing, quality, procurement who 
are not involved directly, but whose help we need, are gen- 
erating plenty of resistance. We are creating more instruc- 
tional paper than engineering data. We wish we could get 
action by verbal request but such is not the case. This is a 
red flag. 


(See appendix У-Н.) 

October 4, 1985. Roger Boisjoly’s Activity Report identified prob- 
lems in obtaining support from Mr. Kilminster for the O-Ring In- 
vestigation Task Force. 

October 30, 1985. STS 61-A experienced erosion of the right-hand 
nozzle primary O-ring to a depth of 0.075 inches over a 13 inch 
space at the 97 degree location. There was also blow-by past the 
primary O-rings in the center and aft field joints on the left-hand 
SRM. But these problems were not discussed at the STS 61-B SRB 
Board Review on November 4, 1985. However, Mr. Mulloy included 
a note at the Shuttle Project Board Review on November 6, 1985, 
“SRM Joint O-ring performance within experience base.” 

November 18, 1985. Mr. Mulloy briefed the Level 1 Flight Readi- 
ness Review stating, ‘‘Post flight inspection of SRM revealed hot 
gas erosion of primary nozzle/case joint-O-ring on right-hand 
SRM— Within previously accepted experience.” 

November 20, 1985. Thiokol briefing document TWR-15349, 
“SRM O-ring Task Force Status and QM-5" Recommendations, 
presented new seal design concepts and recommendations for Qual- 
ification Motor-5 testing on February 20, 1986. 

November 26, 1985. STS 61-B experienced primary O-ring erosion 
in both nozzle joints. There was also blow-by past the primary O- 
ring in the left-hand nozzle joint. These observations were noted at 
the STS 61-C SRB Board Flight Readiness Review on December 2, 
1985. 

December 4, 1985. At the STS 61-C Shuttle Project Board, Mr. 
Mulloy noted “SRM joint O-ring performance within experience 
base.” The Commission’s copy of the December 9, 1985, Marshall 
Center Board briefing was incomplete; however, at the December 
11, 1985, Level I Flight Readiness Review, it was reported that 
there were “No 61-B flight anomalies." 
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December 11, 1985. Thiokol management holds a Solid Rocket 
Motor Flight Readiness Review for STS 51-L. No discussion of O- 
ring anomalies occurs. 

December 17, 1985. Larry Wear holds a Flight 51-L Solid Rocket 
— Project Flight Readiness Review at Marshall Space Flight 

enter. 

January 3, 1986. The Level III Flight Readiness Review for Flight 
51-L takes place at Marshall. SRB recovery system changes are the 
primary point of discussion. 

January 9, 1986. Larry Mulloy makes his Flight 51-L presenta- 
tion at the MSFC Shuttle Projects Office Readiness Review. SRB 
parachutes are discussed. O-rings are not. 

January 12, 1986. STS 61-C experienced nozzle Joint O-ring ero- 
sion and blow-by and a field joint O-ring was eroded 0.011 inches 
over an 8 inch span at the 162 degree location. There was blow-by 
past the primary O-ring in the left-hand nozzle joint between the 
255 degree and 335 degree locations. The primary O-ring in the left 
SRM aft field joint was eroded 0.004 inches over a 3.5 inch span at 
the 154 degree location. 

January 13, 1986. Marshall Space Flight Center 51-L Readiness 
Review. Mulloy again does not mention O-ring anomalies. 

January 14, 1986. Mulloy’s Flight 51-L presentation to the Level 
II Flight Readiness Review indicates there were “no 61-C flight 
anomalies.” 

January 15, 1986. During the STS 51-L Level I Flight Readiness 
Review, Mr. Mulloy noted that there were "Мо 61-C Flight Anoma- 
lies," and that there were “Мо major problems or issues." 

January 25, 1986. According to Mr. McDonald, Mr. Mulloy men- 
tioned that 61-C had suffered O-ring erosion “within experience 
Базе” at the STS 51-L L-1 Flight Readiness Review. 

January 26, 1986. The Orlando Sentinel printed an article titled, 
“Bitter freeze is expected to clobber state Tuesday.” 322 

January 27, 1986. Thiokol and Marshall personnel spend approxi- 
mately three hours in a teleconference debating the effect that pre- 
dicted low temperatures will have on the performance of the O-ring 
seals. 

January 28, 1986. The ice/frost evaluation team visits Launch 
Complex 89В at 1:45 a.m., 6:45 a.m. and 10:30 a.m. Meeting with 
Rockwell personnel concluded with a decision to continue the 
launch countdown. 

January 28, 1986. STS 51-L was launched at approximately 11:38 
a.m. Eastern Standard Time. 


2. SUMMARY OF CASING JOINT DESIGN 


Issue 

Why did the aft field joint between the steel containers that hold 
the Solid Rocket Motor propellant fail to contain the burning gases 
of the propellant during lift-off and flight operations? 


заа John Wark, “Bitter Freeze is Expected to Clobber State Tuesday," The Orlando Sentinel, 
Jan. 26, 1986, p. B-3. 
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Findings 


1. The design of the field joint was unsatisfactory and could not 
reliably contain the burning propellant gases under the range of 
ОРГАНЕ conditions to be expected during the lift-off and flight 
phases. 

2. The O-ring materials and putty used in the design of the joint 
were unsatisfactory as used on the Shuttle, particularly during the 
winter months. Furthermore, neither NASA nor its contractor, 
Morton Thiokol, can adequately control the quality or consistency 
of these kinds of materials, which are made from recipes known 
only by the manufacturer and which can be changed without certi- 
fication and approval. 


Recommendations 


1. NASA should write and issue a new and more accurate per- 
formance specification which would cover the full range of thermal 
and structural requirements for the Solid Rocket Motors, with an 
adequate factor of safety for unusually low temperatures. 

2. The Committee concurs with the Rogers Commission Report 
Recommendations on new joint design, but believes it is more ap- 
propriate to be more explicit in identifying the weaknesses in the 
joint design that need correction. 

3. The field joints of the Solid Rocket Motors should be rede- 
signed to account for the following features while providing a sig- 
nificant factor of safety: 

a. Movement in the joint; 

b. Proper spacing between tang and clevis; 

c. Seals made to withstand high and low temperatures under 
all dynamic thermal and structural loadings; 

d. Adequate sealing without the use of putty; 

e. Protection against insulation debonding and propellant 
cracking. 


Discussion 


This section is a summary of Section VII, Casing Joint Design. 
For details and substantiation of the statements made in this sum- 
mary, refer to Section VII. 

The evidence, consisting of recovered pieces of the right Solid 
Rocket Motor casings, photographs of smoke and flame emanating 
from the right Solid Rocket Motor and telemetry data transmitted 
from STS 51-L back to Mission Control at the Johnson Space 
Center verify the failure of the aft field joint of the motor. 

As mentioned earlier, NASA’s performance specifications did not 
anticipate operations at temperatures below 31 degrees, a tempera- 
ture that might occur in Florida during the winter months. The 
design of the joint was unsatisfactory to provide for the low tem- 
peratures or water in the joints that existed on January 28. While 
it was based on an existing similar rocket casing joint design that 
had been successful, the design was changed to accommodate the 
manufacturing requirements of the larger sized shuttle rocket 
motors. There were even some features of the revised design that 
indicated the changes were an improvement. It was easier to as- 
semble in the field and it had a second O-ring. The designers 
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thought if the first O-ring failed, the second would surely hold the 
propellant gases. 

The casing joints, as described in the Introduction, have to with- 
stand various structural loads, which change dramatically as the 
shuttle is assembled, through launch operations, separation of the 
Solid Rocket Booster and retrieval from the ocean. The joint is dy- 
namic; the components move under these loads. The loads carried 
by the aft field joint are different from those carried by other 
joints. The design, based on these loads and 24 successful missions, 
appeared satisfactory. 

One of the loads, however, that of the propellant gas pressure, 
was not adequately accommodated. The zinc chromate putty, in- 
tended to protect the O-rings from this high temperature and rela- 
tively high pressure gas, frequently failed and permitted the gas to 
erode the primary O-rings. 

Instead of redesigning the joint, NASA and Thiokol persisted in 
trying to fix the problem by changing leak-test pressures, changing 
the size of the O-rings, and trying to control proper spacing be- 
tween the tang and clevis where the O-rings were located. 

Complicating this problem, two of the materials used in the joint, 
the putty and the fluorocarbon elastomer O-rings, were not suited 
to the task of containing the propellant gas under the full span of 
Shuttle operating conditions. The behavior of the fluorocarbon elas- 
tomer O-rings was something of a mystery to NASA and its con- 
tractor. The material was “proprietary,” meaning that the con- 
stituents used were known only to the manufacturer. Fluorocar- 
bons are expensive, so fillers are frequently added to reduce the 
cost of the material. These materials behave unlike most other ma- 
terials. The particular material used in the manufacture of the 
shuttle O-rings was the wrong material to use at low tempera- 
tures.33 Nitrile or silicon based materials would have demonstrated 
better performance characteristics. 

It became necessary to find a new putty when the original sup- 
plier, Fuller O'Brien, stopped making it because it contained asbes- 
tos. The characteristics of the new putty changed substantially in 
response to the quantity of water in the air and it was difficult to 
apply in both the dry climate of Utah and the dampness of Florida. 
Its performance in use was highly unpredictable. Again, NASA and 
its contractor tried to make up for the unsatisfactory material by 
storing it under refrigeration prior to application in Florida. 

After ignition of the solid propellant in the SRM, it was learned 
that the O-ring could be seated by the motor's gas pressure yet still 
suffer erosion as the hot gases came in contact with it. As men- 
tioned, O-ring erosion was noted after various flights and tests. 
Also seen was damage given the name “blow-by”, a condition 
where erosion was not necessarily present but where there was evi- 
dence that the propellant gas had bypassed the primary O-ring. 
But rather than identify this condition as a joint that didn't seal, 
that is, a joint that had already failed, NASA elected to regard a 
certain degree of erosion or blow-by as "acceptable." To make mat- 
ters worse, confidence was mistakenly obtained from a mathemati- 


33 NASA's primary concern was having a very durable material with excellent high tempera- 
ture performance characteristics. 
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cal model which suggested that if the erosion did not exceed а spe- 
cific depth, the O-ring would still seal that joint. In cases where the 
erosion did exceed the maximum predicted by the model, NASA ex- 
panded its experience base to cover this increased damage. 

As the joint seals continued to exhibit erosion or blow-by or both, 
more research illustrated the importance of maintaining proper 
gap spacing between the tang part of the joint and the O-ring face 
of the inner clevis leg. Too little space, and the O-rings would not 
seal. Too much space, and again the seals would fail. Since the 
joint opens, or "rotates," when the Solid Rocket Motor is ignited, 
maintaining proper spacing was difficult if not impossible. The 
maintenance of such close tolerances in spacing, on the order of 20 
thousandths of an inch, while joining 300,000 lb. segments that 
have been bent during shipment, was not sufficiently provided for 
in the design. Months passed until, in 1985, engineers at NASA rec- 
ognized that the design was unsatisfactory. In fact, NASA had writ- 
ten to several other contractors soliciting help with the joint prob- 
lems. Unfortunately, in the quest to meet schedule and budget, the 
warnings of the engineers were not heeded. 

Based on the above conditions and the evidence, the Committee 
has endeavored to determine the way in which the joint failed; rec- 
ognizing that such a determination is difficult, if not impossible, to 
make with 100% certainty. 

The following is the most probable sequence of the joint failure: 

1. The failure occured in the lower assembly joint near a strut 
that connects the Solid Rocket Booster to the External Tank. 

2. At that location, the spacing between the two casings was too 
small to facilitate a tight seal. 

3. Also, at that location, there probably existed a hole through 
the insulating putty, which would act as a conduit concentrating 
the hot propellant gas on the primary O-ring. 

4. The freezing temperatures reduced the capability of the O- 
rings to seal. Worse, at this particular location, near the connect- 
ing strut, the joint was made even colder by the further loss of 
heat caused by the direct connection to the liquid hydrogen fuel, at 
423 degrees below zero, in the external tank. 

5. When the Solid Rocket Motors were ignited, the pressure from 
the motor changed the spacing between the casings. Among other 
effects, this can prevent the secondary O-ring from sealing. 

6. Seven inches of rain fell while the shuttle was being prepared 
for launch. Water very likely penetrated the joints and froze. Ice in 
the joints could have dislodged the secondary O-ring even if the 
change in spacing, coupled with a cold and stiff O-ring, did not. 

7. Smoke at ignition occurred at a location near the connecting 
strut to the external tank. At that location, the primary O-ring was 
either unseated or eroded and the secondary O-ring was unseated. 

8. The primary O-ring was sealed at other locations around the 
motor casings. 

9. The breach in the primary O-ring clogged with burned char 
and aluminum oxide from the propellant in less than 3 seconds, 
causing the smoke to stop. 

10. At 37 seconds, 45 seconds and 58 seconds into the flight, the 
Space Shuttle encountered heavy turbulence, which forced the 
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steering controls to cycle through changes more severe than previ- 
ous flights. 

11. After throttling back to 65% power as planned, at 57 seconds, 
power was increased to 104%. 

12. The combined effect of the turbulence and the increase in 
power caused the material which clogged the joint to break free, 
reopening the joint. 

13. A flame from the right Solid Rocket Motor was seen at the 
location near the connecting strut. 

14, This flame burned through the external tank and caused the 
destruction of the shuttle. 

Since the technical faults in the joint design must be corrected if 
safe shuttle flight is to resume, this subject has been discussed in 
more detail in Section VII. 


3. TESTING AND CERTIFICATION 


Discussion 


In developing the Solid Rocket Motor, Thiokol concentrated most 
of their efforts and concerns on the proper design and performance 
of the propellant. There is no question that this is where the em- 
phasis on safety and performance is required. The propellant is a 
high performance material, dangerous to manufacture and handle 
and which must be prepared to the highest quality standards. Con- 
sequently, testing and certification of the propellants, as well as its 
performance, was carefully controlled. This does not mean that the 
design of the casings was ignored. Considerable attention was paid 
to the design of the casings because they were larger than seen on 
any previous Solid Rocket Motor, because this Solid Rocket Motor 
would be used on a manned flight system, and because these par- 
ticular motors would be brought back, refurbished and reused. 
Given this background, the testing of the joint was included in 
static firing tests. While there were no special tests conducted to 
confirm and certify the joint as a separate item, analysis was per- 
formed to assure that the joint was adequate. Later, during the op- 
eration of the Solid Rocket Motor, it was discovered that the per- 
formance of the joint was unsatisfactory. 


4. MANUFACTURING 


The Solid Rocket Motor is 126 feet long and 12 feet in diameter. 
The propellant weighs 1.9 million pounds and the average thrust is 
2.3 million pounds. Fifty of these motors have been produced. The 
segmented Solid Rocket Motor case is roll formed from D6AC steel. 
The case is weld-free and consists of eleven segments. The ргоре]- 
lant is made in batches at 135 degrees F and it takes 40 to 43 of 
these batches to load one casting segment. One segment includes 
two steel cases which are joined in the factory. The content and 
quality of the materials used to make the propellant is inspected 
prior to mixing. The motor is designed for a short burn time (122 
seconds) and therefore has a high mass flow which requires a large 
burning surface. In manufacture, either new steel casings or previ- 
ously used casings are employed. The first step is to apply the 
rubber insulation liner around the inside of the casings. The insu- 
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lation is removed from а roll апа spread around the inside of the 
casings with special tooling. After application it is cured in place in 
an autoclave. After the casings have been insulated, they are 
placed in a casting pit. The propellant is then poured into the cas- 
ings under vacuum. The propellant is then cured and the casings 
are removed from the pit. There is no indication that there were 
Puy manufacturing defects that contributed to the loss of the Chal- 
enger. 


5. STACKING OPERATIONS 


Issue 


Was there any damage to the casing joints or contamination that 
occurred during the stacking operations when the Shuttle was as- 
sembled in the Vehicle Assembly Building (VAB) that could have 
contributed to the failure? 


Finding 

There was no evidence of joint contamination, fracture, or other 
damage from foreign objects or due to casing ovality that contribut- 
ed to the joint failure. Although certain problems occurred during 


stacking and the procedures were violated once, there was no evi- 
dence that these events contributed to the Flight 51-L accident. 


Discussion 


The discussion of the assembly of the aft field joint on the right 
hand Solid Rocket Booster is drawn from the “STS 51-L SRB Joint 
Mate Review Team" report 33а The report was provided to Commit- 
tee staff during the Committee's trip to KSC on June 6, 1986. 

There were 24 Solid Rocket Booster sets (48 SRBs) stacked prior 
to STS 51-L. The stacking experience of the technicians involved in 
STS 51-L ranged from 5 to 20 stacking operations. Sixty percent of 
the technicans and all of the supervisory personnel, including lead 
technicians, had participated in the 14 stacking operations per- 
formed since the Shuttle processing contract was awarded to Lock- 
heed. Thiokol managed the stacking operations for Lockheed under 
a subcontract. The NASA Accident Review Team found that all 
personnel assigned to the stacking of STS 51-L were experienced 
and qualified to perform their assigned tasks. 

Aft segment receiving inspection and processing in the Rotation, 
Processing and Surge Facility (RPSF) was normal. No problems 
were reported relative to the aft segment clevis during offload from 
the railcar, mate to the aft skirt, aft booster assembly, or in prepa- 
ration for transfer to the Vehicle Assembly Building (VAB) for 
stacking. Some surface defects were identified on non-sealing sur- 
faces of the aft segment clevis, but were found not to exceed the 
specification in the Operations and Maintenance Requirements 
Specification (OMRS) document. There were no defects identified in 
the clevis O-ring grooves. The aft segment was processed normally 
in the RPSF to prepare for stack. 


33a NASA, J. Robert Lang, KSC, “STS 51-L SRB Joint Mate Review Team Report," March 18, 
1986. 
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A problem was reported at the 165-168 degree location where а 
segment case-to-insulation bondline separation 0.109 inch in depth 
(longitudinally) was found. The OMRS document specifies no sepa- 
rations in excess of 0.050 inch. A Material Review Board (МЕВ) 
repair was approved and the separation was filled with an asbestos 
float-filled, liquid epoxy resin sealant. This repair is standard for 
this type of separation, and has been performed on numerous seg- 
ments. Some surface defects were identified on the tang, but none 
were found to exceed specification. 

The right aft booster assembly was transferred from the RPSF 
directly to the VAB transfer aisle. Positioning of the aft booster as- 
sembly on the Mobile Launch Platform (MLP) holddown posts was 
normal. One iteration of shimming was performed and the subse- 
quent holddown post strain gauge output indicated proper distribu- 
tion of aft booster assembly loads. 

Holddown hardware was installed and stud tensioning began 
with ultrasonic measurement of stud initial lengths. A problem 
was reported at holddown post #1 when ultrasonic measurements 
indicated a stud length twice the actual. The stud and associated 
hardware at post #1 were removed for offline bench testing. The 
problem was isolated to a faulty ultrasonic transducer. While 
awaiting replacement hardware, studs at holddown posts #3 and 
#4 were tensioned satisfactorily. The stud at holddown post #2 
was tensioned but adequate margin was not attained. 

This problem in tensioning studs at holddown posts #1 and #2 
led to a revision in the schedule. All left hand Solid Rocket Motor 
segments were stacked while problems on the right hand side were 
resolved. This procedure had been employed in one-third of the pre- 
vious stacking operations and was not an uncommon method of 
stacking. 

After installation of the replacement hardware at holddown post 
#1, studs at posts #1 and #2 were tensioned. The replacement 
stud at post #1 was brought up to satisfactory tension, but con- 
cerns over stud tension at post #2 prompted engineering to re- 
quest that a problem report be generated. 

Engineering determined the tension (approximately 690,000 lbs.) 
was adequate for SRB stacking, but marginal for launch loads. 
Therefore, stud removal and replacement was planned after SRB 
stack but prior to Orbiter mate. 

While holddown post stud tensioning proceeded, preparation and 
inspection of the aft segment clevis was put in work. No problems 
were identified on the aft segment clevis during this inspection. 
Since a stacking delay was evident, the clevis was secured and 
sealed to maintain inspection integrity until stacking could resume. 

A Solid Rocket Motor configuration change was released as a 
result of a handling incident. The SRM-25 left forward center seg- 
ment was damaged during processing in the RPSF.?* Deviation Ap- 
proval Request (DAR) Number RWW-376R1 was approved to re- 
place the damaged segment with a left forward center segment for 
SRM-26 motor set. In order to prevent flight performance imbal- 
ance, the right aft center segment was also reassigned from SRM- 


34 Mishap Report 86-0024, В.С. Smith, “Report of SRM Handling Ring Mishap Investigation 
Board, Dec. 13, 1985. 
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26 to the SRM-25 flight motor set. The SRM-26 right aft center 
segment was transported to the VAB for stacking. 

While this segment was outside the VAB, a storm occurred. A 
Problem Report was generated as rain water was reported leaking 
from under the segment protective covers. The segment was 
brought into the VAB transfer aisle and hoisted for pre-stack in- 
spection. At this time, all visible moisture was removed from the 
aft surfaces of the segment. Inspections were performed and no 
problems were identified as a result of rain water intrusion. The 
MRB repair of the separation of insulation from the segment case 
located at 165/168 degrees was reinspected and final acceptance 
was verified. A complete inspection of tang surfaces and aft insula- 
tion surfaces was performed and no problems were identified. 

The use of this segment violated assembly procedure which re- 
quires that the segments be protected from direct water entry and 
it should not have been employed. While there is no evidence of a 
direct connection to the joint failure, the decision to use this aft 
center segment was a compromise that need not have been made. 

The aft segment clevis diameter was measured at six locations 
and corresponding measurements were taken of the aft center seg- 
ment tang. Measurements indicated that a potential for interfer- 
ence existed along the 0/180 and 30/210 degree axes where the 
tang diameter was larger than that of the clevis. The normal proce- 
dure for changing the shape (ovality) of the tang was initiated. The 
procedure calls for reconfiguration of the segment lifting beam 
from a four-point to a two-point lift configuration to decrease the 
tang outside diameter along the axis of interference. The procedure 
was followed and after stabilization, a decrease in tang diameter of 
0.178 inch was measured along the axis of potential interference. 
Shuttle Processing Contractor (SPC) engineering was called on to 
evaluate the latest overall characteristics of the joint. At that time 
the aft center tang was larger in diameter than the aft segment 
оро by more than 0.31 inches along the two axes, 0/180 апа 30/ 

These measurements still indicated a potential for interference 
based upon normal KSC experience. SPC engineering determined 
that additional deflection of the aft center segment case was neces- 
sary and prescribed installation of the SRM Circumferential Align- 
ment Tool along the 16/196 degree axis of the tang. The Circumfer- 
ential Alignment Tool was installed and maximum hydraulic pres- 
sure was applied (1200 psig), producing a deflection of 0.196 inch. 
Later an unspecified torque on the Circumferential Alignment Tool 
tension rod nut produced an additional deflection of 0.040 inch. 
This additional torque caused an additional load and exceeded the 
safe working limit of the tool. Technicians noticed an increase in 
hydraulic pressure on the pumping unit gauge to 1300 psig at the 
time torque was applied. This pressure indicates a force of up to 
3250 pounds may have been applied to the segment case. Currently, 
a force of 5000 pounds may be applied to the segment case. The 
safety limits of the Circumferential Alignment Tool were exceeded 
(safety factor reduced to 1.2), but the force applied to the segment 
case was still well below the established maximum. However, the 
procedure was determined to be inappropriate by the post-accident 
investigation. 
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The alignment tool used on the aft center segment of STS 51-L's 
right hand Solid Rocket Motor is now considered inappropriate by 
NASA due to the concentrated loads applied at two points. А new 
alignment tool is now being designed. However, the use of this tool 
did not appear to have contributed to the STS 51-L's accident. 

With the Circumferential Alignment Tool installed, the right aft 
center segment was hoisted from the transfer aisle and positioned 
above the aft segment in the VAB High Bay. Installation of pri- 
mary and secondary O-rings was performed, and no problems were 
identified. Closeout photographs were then taken showing the O- 
ring and zinc chromate putty installation. 

The joint mating operation proceeded with final inspection of the 
greased joint surfaces. No problems were identified during engage- 
ment of the tang into the clevis, aided by the nearly co-planar rela- 
tionship of the mating surfaces (within 0.15 inch). The joint mate 
was completed with installation of all clevis pins and pin retainer 
clips per the normal procedure. No difficulties were encountered. 

After disconnection of the segment lifting beam, the SRM field 
joint leak test was performed. Following the 200 psig pressuriza- 
tion, the 50 psig decay test was performed and zero pressure decay 
was recorded, indicating successful assembly of the joint (maximum 
allowable decay is 1.0 psig over a 10 minute period). 

Field joint closeouts were performed in the normal fashion. No 
problems were reported during pin retainer band and cork insula- 
tor installation. Data also indicated normal application of the bead 
of grease around the seam of the joint. Installation of the systems 
tunnel floor splice plate across the field joints at the 90 degree loca- 
tion completed the closeout. 

Because of its unique design, the clevis of the aft case must 
always be used as the field joint at the forward end of the aft seg- 
ment. It was previously flown on the left booster segment on STS 
51-C. It was also utilized in qualification test motor QM-4 which 
was static test fired at Thiokol's Utah plant. 

The field joint tang of the STS 51-L aft center segment (serial 
number L60 had flown previously as forward center segment to aft 
center segment field joint tang on the left booster on STS 41-D. 

In a memo to J. Harrington of NASA's Data and Design Analysis 
Task Force on February 24, 1986, the Chairman of the SRB Joint 
Mate Review Team noted the conclusion that the 200 psig O-ring 
seating operation could produce a blowhole in the putty. Such a 
blowhole would not be known prior to launch. Since the putty is 
intended to provide a heat shield to protect the O-rings, the O-rings 
would be unprotected in cases where blowholes occurred. 


6. SUMMARY OF LAUNCH OPERATIONS 


Issue 1 


How was the decision to launch STS 51-L arrived at and why 
was it wrong? 


Findings 
1. The Flight Readiness Review for STS 51-L was conducted in 
accordance with established procedure. 
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2. The decision to launch STS 51-І, was based оп a faulty епрі- 
neering analysis of the SRM field joint seal behavior. 

9. Compounding this erroneous analysis were serious ongoing 
weaknesses in the Shuttle Safety, Reliability, and Quality Assur- 
ance program which had failed to exercise control over the problem 
tracking systems, had not critiqued the engineering analysis ad- 
vanced as an explanation of the SRM seal problem, and did not 
provide the independent perspective required by senior NASA 
managers at Flight Readiness Reviews. 

4. The initial response of Marshall managers to the attempts of 
Thiokol engineers to raise the issue of temperature effects on the 
SRM seals caused Thiokol management to discount proper techni- 
cal concerns and engineering judgement in their recommendation 
to launch. 

5. The Director of Marshall’s Shuttle Projects Office may have 
violated NASA’s Flight Readiness Review policy directive by failing 
to report the results of the January 27 teleconference to the Associ- 
ate Administrator for Space Flight. 

6. The decision of the STS Program Manager to launch despite 
the uncertainty represented by ice on the Fixed Service Structure 
was not a prudent effort to mitigate avoidable risks to the Shuttle. 

7. The Launch Director failed to place safety paramount in eval- 
uating the launch readiness of STS 51-1. 

8. No launch should have been permitted until ice was cleared 
from the platform leading to the pad escape system. 

9. Ice Team personnel and Rockwell contractors properly con- 
veyed their inability to predict the post-ignition behavior of ice. 

10. Post-flight analysis indicated that ice did not exhibit the be- 
havior predicted by analysis, and that ice traversed a distance suf- 
ficient to strike the Shuttle during lift-off. 

11. Failure to enforce a clear requirement for definite readiness 
statements contributed to failures in communication between 
NASA and its contractors during launch preparations. 


Discussion 


Significant in the loss of Challenger was NASA’s decision to 
launch the Shuttle on January 28. The Rogers Commission and the 
Committee investigation found sufficient evidence to indicate that 
STS 51-L should not have been allowed to lift off until a number of 
problems had been corrected. The Committee has examined docu- 
mentation made available to the Rogers Commission and has re- 
viewed recordings made of conversations among personnel in KSC 
Firing Rooms on January 27 and 28 in developing its analysis. 

What seems evident in the Committee's review of this material is 
that clear indications existed on the morning of January 28 argu- 
ing that a launch of the Shuttle vehicle would not be a prudent de- 
cision. Significantly greater risks were present for this launch at- 
tempt than were usually found during a launch of the Shuttle. De- 
spite these signals, some of which reached officials with the author- 
ity to delay the launch, STS 51-L was allowed to proceed. The 
Committee is disturbed that expected safeguards in the launch de- 
cision process failed to operate. 

Specifically, this section examines the inability of the Flight 
Readiness Review procedure to compensate for poor technical anal- 
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ysis in preparing the Shuttle system for launch. Also, the efforts 
initiated by Thiokol engineers to delay the launch until SRM seal 
temperatures had risen were unsuccessful, nor were their argu- 
ments conveyed to the Associate Administrator for Space Flight, as 
NASA policy apparently requires. Finally, the heavy ice on the pad 
Fixed Service Structure led NASA’s ice team leader to recommend 
that the launch be scrubbed, but his objections were apparently 
never conveyed to the STS Program Manager. The Committee con- 
cludes that sufficient warning of the risks to STS 51-L was avail- 
able, and the launch therefore should not have occurred. Readers 
are directed to Section VIII-A of this report for a complete discus- 
sion of each of these areas. 

NASA has developed a highly involved procedure to prepare a 
Shuttle mission for flight. Much of this preparation is discussed in 
Section VI-A.2.b. In the period immediately proceding a launch, 
project and program managers participate in a number of meetings 
that together are known as the Flight Readiness Review. In the 
case of the Solid Rocket Motor, the apparent cause of the accident, 
eight levels of review were required to certify the flight readiness 
of the STS 51-L hardware. (See Table I for date and scope of these 
reviews) 

Flight Readiness Reviews employ the so-called “delta review” 
concept, meaning that the data presented only represents those ele- 
ments on the previous flight that fall outside the expected perform- 
ance of the hardware. The responsible project or program manager 
must then explain the failure to the satisfaction of the review 
board and describe the steps that have been taken to assure that 
the situation will not recur on the upcoming flight. In the case of 
STS 51-L, however, this concept permitted the SRM seal erosion 
problem to evade scrutiny. STS 61-C, the mission immediately pro- 
ceding 51-L, did not fly until halfway through the 51-L FRR cycle. 
Thus, there was no previous mission to obtain data from Only at 
the last stage of the cycle, at the L-1 review, did the Associate Ad- 
ministrator learn that the SRM seal erosion problem had been 
noted again. Mr. Mulloy’s presentation characterized the situation 
— the experience base,” according to Thiokol’s Mr. McDon- 
ald. 

The history of SRM seal erosion demonstrates the effect that 
faulty engineering analysis has on the Flight Readiness Review 
process. Thiokol and Marshall engineering personnel declared the 
seal erosion problem to be “acceptable,” even though the seal 
design clearly recognized that the elastomeric O-ring seals were not 
designed to stand up to propellant gases during flight. Relying on a 
computer model of the situation and a limited battery of tests, 
Marshall continued to present the situation in Flight Readiness Re- 
views as "within the experience base;" that is, the deterioration in 
the seals was no worse than previous cases and thus no concern 
was warranted. 

It is the conclusion of the Committee that the Flight Readiness 
Review operated as well as its design permitted in the case of STS- 
51-L. See Section VI-B.1.b.3. It seems clear that the process cannot 
compensate for faulty engineering judgement among participants. 
Had the engineering analysis led Marshall to a different conclusion 
about the severity of the SRM seal erosion problem, the system 
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would have reacted to these concerns long before the 51-І, Flight 
Readiness Review. 

If the Flight Readiness Review process did not fail, however, why 
was STS 51-L launched? The Committee is seriously concerned by 
the fact that information indicating that the SRM seals might fail 
became available in time to delay the launch, and yet these con- 
cerns were overridden. Engineers from Marshall and Thiokol 
argued for hours on the night of January 27 regarding the effect of 
temperature on the performance of the seals. In the end, Thiokol 
managers chose to recommend that the launch proceed over the ob- 
jections of their engineering staff. 

In hindsight, it is unfortunate that Thiokol engineers did not 
present their objections in terms of developing a new launch 
commit criteria on the SRM joint seal temperature. Doing so would 
have required that the STS Program Manager would have had to 
listen to the engineers’ presentation. It would also have guaranteed 
that a more rigorous analysis of the situation would have been 
forthcoming, simply to explain why the situation had been allowed 
to continue for so long. Even so, the Committee’s investigation indi- 
cates that these discussions should have been brought directly to 
the attention of the Associate Administrator for Space Flight by 
Marshall’s Shuttle Project Office Director. The Committee’s inves- 
tigation also questions whether doing so would have altered the de- 
cision made on January 28. (See Section VI-B.1.b.4) 

The question remains: Should the engineering concerns, as ex- 
pressed in the pre-launch teleconference, have been sufficient to 
stop the launch? The Committee concludes the answer is yes. Thio- 
kol’s recognized expert on SRM seals had evidence he believed con- 
clusive and sufficient. His opinion, in the absence of evidence to 
the contrary, should have been accepted until such time as better 
information became available. 

Finally, the Committee examined the taped conversations among 
NASA and Rockwell personnel discussing the ice that covered the 
pad’s Fixed Service Structure on January 28. Because the tempera- 
ture dropped below freezing, NASA had permitted critical water 
systems on the pad to run during the night. The pad drainage 
system could not handle the water flow, and allowed water to spill 
out onto the gantry platforms and freeze. 

NASA personnel were sent to the pad to examine the situation 
and determine whether the situation posed a threat to the Shuttle. 
What they found was described by Rockwell personnel as “зоте- 
thing out of Dr. Zhivago." Icicles hung from platforms and hand- 
rails, and could be easily broken off. Sheets of ice covered the 
gantry platforms, including the platform across which the crew 
would have to run if it became necessary to use the pad escape 
system. The ice team leader indicated that he felt the situation was 
a distinct hazard to the Orbiter thermal protection system, since 
Main Engine ignition would likely release a great deal of ice 
debris. Blown by the wind or sucked up by the engines and boost- 
ers, the ice could inflict damage on the delicate silica titles that 
made up the Orbiter heat shield. Asked for his opinion, the ice 
team leader recommended that the launch be scrubbed until the 
ice had been removed from the gantry. 
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Rockwell personnel in Downey, California, expressed similar con- 
cerns about the situation after seeing the pad on television. They 
attempted to determine what would happen to the ice by use of 
computer modelling, but were not satisfied with the result. Rock- 
well’s chief engineer finally concluded that the situation was little 
better than “Russian roulette." The company’s liaison at KSC 
noted that the situation was much worse than the threat from ice 
in the liquid oxygen vent arm, which NASA considered a definite 
threat to the Orbiter. However, the STS manager, relying on an 
analysis by engineers at KSC and JSC (using the same model Rock- 
well found inadequate), decided to launch. 

As a whole, the Committee’s review of the decision to launch 
STS 51-L on January 28 indicates a number of questionable prac- 
tices. It is not clear to the Committee why so many warnings went 
unheeded by NASA personnel that morning. What is certain, how- 
ever, is that the Associate Administrator for Space Flight and the 
Associate Administrator for Safety, Reliability and Quality Assur- 
ance should restore a more conservative set of launch rules prior to 
resuming flights of the Space Transportation System. 


Issue 2 


Should firing room personnel be allowed to waive launch commit 
criteria or equipment redlines during a launch countdown without 
a well-developed technical reason for doing so? 


Finding 
NASA’s management waived its own launch commit criteria on 
January 28, 1986, without a valid technical reason for doing so. 


Discussion 


Conversations obtained from the Operational Intercommunica- 
tion System (OIS), used by the launch team during Shuttle count- 
downs, indicates that launch commit criteria were waived without 
sufficient technical justification on January 27 and 28. The Com- 
mittee reviewed tapes and transcripts which indicate that engi- 
neering personnel wrote a waiver for launch commit criteria on the 
External Tank nose cone temperatures that justified using lower 
temperatures on the basis of a backup procedure that was invalid. 

Should the temperature sensors in the ET nose cone fail, accord- 
ing to Launch Commit Criteria 5.1-4, a secondary procedure corre- 
lating data obtained from telemetry channels with a previously de- 
rived curve could be substituted. The curve, however, was limited 
to an ambient temperature range of 40-99 degrees Fahrenheit. Am- 
bient temperatures were outside this range during the countdown, 
meaning that the backup procedure could not be used. According to 
the Launch Commit Criteria, exceeding the lower temperature 
limit could cause “inaccurate ullage pressure readings.” Since 
these pressure readings might be significant in operation of the 
Shuttle’s main engines, inaccuracies might have threatened the 
safety of the mission. During flight, pressure in the fuel tanks for 
the main engines is maintained by bleeding off excess gas from the 
main engine heat exchangers and circulating it back into the Ex- 
ternal Tank. Misreading the pressure might cause the Orbiter gen- 
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eral purpose computers to over- or underpressurize the tanks and 
disrupt fuel flow to the engines. 

Also, in discussion with Thiokol personnel during the latter 
stages of preparing this report, the Committee learned that liquid 
hydrogen remained in the External Tank throughout the night of 
January 27. Notwithstanding the effect this had on heat transfer 
through the aft attachment strut (see Section VII on casing joint 
design), this indicates that criteria requiring an eight-hour period 
between tanking cycles may have been violated. This is significant 
in that, had the tanking cycles been carried out as required, launch 
of STS 51-L would have taken place in the afternoon of January 28 
or the next day. The Committee has not confirmed this possibility. 


7. RETRIEVAL, TRANSPORTATION, AND REFURBISHMENT 


Issue 


Were the motor casings used on STS 51-L damaged as a result of 
the retrieval, transportation and refurbishment operations follow- 
ing previous launches? 


Finding 
There was no evidence of damage to the casings or joint due to 
prior use or preparation for reuse. 


Discussion 


The aft field joint on Flight 51-L was between two casings that 
were used previously on STS 51-C. After approximately two min- 
utes of burn-time during the launch operation, the Solid Rocket 
Boosters are separated from the External Tank, at which time they 
fall toward the ocean for a considerable distance. Before impact, 
parachutes are deployed from the Solid Rocket Boosters to slow 
their decent and minimize impact forces. The Solid Rocket Boosters 
strike the ocean at a speed of approximately 60 miles per hour (ver- 
tical speed component). (There has been no evidence that the cas- 
ings are distorted by impacting the ocean since the impact loads 
are low and the cases are still assembled at this point.) The para- 
chutes and boosters are retrieved by divers at sea and both Solid 
Rocket Boosters are towed back to the Cape by ships. They are 
towed into a special dock, lifted in slings, conveyed to a wash rack 
and completely washed down to remove salt water. The casings are 
made of high carbon steel which is very susceptible to corrosion. 
The casings are then disassembled, given a visual inspection, and 
shipped back to Utah for refurbishment. At a plant in Clearfield 
they are further cleaned and "shot with glass beads" to assure that 
all foreign contaminants have been removed. The cases are then in- 
spected to determine the dimensions of tang and clevis and for 
cracking. Inspection for cracks is performed by using a magnetic 
flux technique. The procedure calls for a test whereby cracks must 
be of such a minimum size as to be able to withstand four more 
flight uses without failure. The casings are then subjected to a hy- 
droburst test where they are pressure tested with a mixture of oil 
and water, to assure sufficient strength to withstand propellant. 
pressure during flight. The hydroburst test is conducted at 1.1 
times the maximum expected operating pressure (MEOP). This 
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gives assurance that the strength can accommodate 10 percent 
more load than the casings will experience in use. There was no 
indication that there had been any damage to the casings from 
Flight 51-C. 


C. EXTERNAL TANK 


Issue 


The External Tank was obviously involved in the accident. Was 
that involvement a cause or an effect? 
Findings 

1. The Committee adopts the "Finding" of the Rogers Commis- 
sion that: “A review of the External Tank’s construction records, 
acceptance testing, pre-launch and flight data and recovered hard- 
ware, does not support anything relating to the External Tank 
which caused or contributed to the cause of the accident.” 35 

2. The External Tank ruptured under the forces of a failed Solid 
Rocket Booster motor. These forces were far outside of any possible 


design considerations that could have been applied to the External 
Тапк.36 


Discussion 


The 154 foot long, 27 foot diameter external disposable fuel tank 
contains the liquid oxygen and liquid hydrogen used by the Space 
Shuttle’s three main engines. Structurally, the External Tank (ET) 
serves as the keel, or backbone, of the Space Transportation 
System. The two Solid Rocket Boosters are attached to the Exter- 
па! Tank near the front and rear of the ET. The Space Shuttle Or- 
biter is also attached to the ET at one forward, and two aft attach- 
ment points. 

The Committee was interested in the findings of the Rogers Com- 
mission concerning the External Tank because it was obvious to all 
that the External Tank was directly involved in the accident. 

The Rogers Commission investigated five potential faults or fail- 
ures of the External Tank which could have contributed to the ac- 
cident.37 

They are: 

Premature detonation of the External Tank Range Safety 
System; 

A structural flaw in the tank; 

Damage at lift-off; 

Structural overload; 

Overheating. 

The Committee is satisfied that the Range Safety System on the 
External Tank did not cause the STS 51-L accident Бесаизе:38 

There is no flight data to support premature detonation of 
the ET range safety package; 


35 Rogers Commission Report, Volume I, p. 42. 
36 Ibid., Volume II, р. L-23. 

37 Ibid., Volume І, p. 41 

38 Ть4., Volume II, p. L-16. 
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1e photographic evidence does not support premature deto- 
nation; 

Most of the explosive charges included in the ET Range 
— System were recovered with the ET wreckage, undeton- 
ated. 

The Committee affirms the Rogers Commission finding that 
there is no data to support structural faults which might have 
propagated to a size which could have caused catastrophic failure 
of the External ТапК.39 

The evidence from the Ice Team examination, and photo analysis 
and television monitoring of the launch give no indication whatso- 
ever that there was any damage to the External Tank during 
launch and lift-off. 

The examination of all flight data indicates that the maximum 
structural load on the External Tank on STS 51-L was less than 80 
percent of the allowable design load from launch until the final ex- 
plosion.*? 

The Committee also affirms the Rogers Commission finding that 
the evidence does not support any theory of independent overheat- 
ing of the External Tank as a cause of the accident.*! 

The failed joint in the Solid Rocket Motor permitted the burning 
solid propellant gases to escape in the direction of the aft External 
Tank attachment strut. Temperatures and velocity of these gases 
caused a rapid erosion and deterioration of the aft strut to the 
point where it failed structurally under turbulence and maneuver- 
ing loads. There were no deficiencies in the design of the external 
strut. However, the strut was not designed to withstand the “blow- 
torch" effect of the propellant hot gas stream. During its investiga- 
tion, the Committee staff visited Martin Marietta's External Tank 
assembly plant in Louisiana. Ап issue raised during this visit was 
whether or not the strut could be relocated such that in the event 
of another joint failure in that vicinity, the strut would not be 
damaged. It was learned that relocating the aft strut created more 
problems that it solved. Furthermore, it was also learned that the 
gas stream would have almost instantly cut through the insulation 
on the External Tank and destroyed it anyway. After the failure of 
the aft strut, the flame continued to bear on the bottom of the Ex- 
ternal Tank, breaching that tank at the joint of the aft dome. This 
caused the liquid hydrogen to escape from the tank. Once the 
flame had penetrated the tank at the weld of the aft dome the fail- 
ure of that weld spread rapidly and completely around the tank's 
diameter severing the dome from the rest of the tank. The burning 
hydrogen ignited by the flame then caused the External Tank to 
act much like a rocket and created an upward thrust. The right 
Solid Rocket Booster without the attachment strut to the External 
Tank, rotated around its long axis.*!^ In so doing, it may have 


39 [bid., Volume I, p. 42. 
40 Ibid. 

41 Ibid. 

418 It should be noted that the right Solid Rocket Booster did not swing outward at the bottom 
and cause the nose of the booster to collide with the External Tank as had originally been 
thought. For this to have happened, the right Solid Rocket Booster would have extended out- 
ward at the bottom at a wide angle that is not supported by any of the photographic or telemet- 
ric evidence. 
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jammed the upper Solid Rocket Booster to the External Tank at- 
tachment structure and caused it to fail. That structure is located 
on a large cross beam in the intertank which in turn possibly dam- 
aged the cross beam. The other distinct possibility is that the burn- 
ing hydrogen forced the External Tank upward and caused the 
cross beam to be damaged and at the same time, caused a rupture 
of the oxygen tank. With the massive release of energy from the 
burning of the hydrogen/oxygen, the Shuttle system completely 
broke apart. 

NASA’s Accident Analysis Team determined that the Orbiter 
was destroyed by aerodynamic forces beyond design limits, not by 
the actual explosion of the External Tank. The report stated, 


All fractures and material failures examined on the Or- 
biter, with the exception of the SSME’s, were the result of 
overload forces and they exhibited no evidence of internal 
burn damage or exposure to explosive forces.*!^ 


D. CREW SURVIVAL 


Issue 
Was the accident of STS 51-L on January 28, 1986, survivable? 


Findings 


In the case of the tragic loss of the Space Shuttle Challenger and 
her crew on January 28, 1986, the Committee is convinced that the 
accident was not survivable. 


Discussion 


During the first two minutes and eight seconds of Shuttle flight 
the two Solid Rocket Boosters provide approximately three million 
pounds of thrust. That thrust is transferred to the External Tank 
through the forward Solid Rocket Booster/External Tank attach- 
ment structure. The thrust is then transferred to the Orbiter 
through the External Tank. While NASA has established a “Fast- 
separation sequence" to allow the Orbiter to separate from the Ex- 
ternal Tank and Solid Rocket Boosters, the engineering analysis in- 
dicates that if separation was attempted while the Solid Rocket 
Boosters were still firing, the Orbiter would “hang-up” on the for- 
ward attachment structure. This would lead to a violent maneuver 
which would greatly exceed maximum aerodynamic loads on the 
Orbiter with resulting structural failure and loss of Shuttle and 
crew. 

During the course of hearings before the Committee on the acci- 
dent the question of survivability was frequently raised. The Com- 
mittee accepts the view of Captain Robert L. Crippen, who in- 
formed the Rogers Commission: 


I've said this before publicly, and T'll say it again, I don't 
think I know of an escape system that would have saved 
the crew from the particular incident that we just went 


41> NASA, Leslie Kampschror, "Space Transportation System Mission 51-L Structural Recon- 
struction and Evaluation Report," Enclosure 8 in "STS 51-L Data and Design Analysis Task 
Force Search, Recovery and Reconstruction Team Report," Volume IV, Rev. A, May 8, 
1986, p. 3. 
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through. I don’t think it is possible to build such а 
system.*? 


Specifically, the Committee finds that the Space Shuttle System 
was not designed to survive a failure of the Solid Rocket Boosters 
during the first 2 minutes of flight; that is, until all the solid 
rocket propellant fuel has been expended. There were no corrective 
actions that could have been taken once the boosters ignited. The 
Challenger was not equipped with any means for separation during 
the first two minutes of flight. In addition, the crew did not have 
any means to escape from the Orbiter during this first-stage ascent. 
Neither the Mission Control Team nor the 51-L crew had any 
warning of impending disaster. Even if there had been warning, 
there were no actions that could have been taken to save the 
crew.*? (The issue of launch abort and crew escape is discussed in 
Section VI.A.2.d.) 

Joseph P. Kerwin of NASA's Johnson Space Center summarized 
the circumstances in a memo to Rear Admiral Richard H. Truly, 
оао Administrator for Space Flight. The undated memo read 
as follows: 


DEAR ADMIRAL TRULY: The search for wreckage of the 
Challenger crew cabin has been completed. A team of engi- 
neers and scientists has analyzed the wreckage and all 
other available evidence in an attempt to determine the 
cause of death of the Challenger crew. This letter is to 
report to you the results of this effort. 

The findings are inconclusive. The impact of the crew 
compartment with the ocean surface was so violent that 
evidence of damage occurring in the seconds which fol- 
lowed the explosion was masked. Our final conclusions are: 

The cause of death of the Challenger astronauts 
cannot be positively determined; 

The forces to which the crew were exposed during 
Orbiter breakup were probably not sufficient to cause 
death or serious injury; and 

The crew possibly, but not certainly, lost conscious- 
ness in the seconds following Orbiter breakup due to 
in-flight loss of crew module pressure. 

Our inspection and analyses revealed certain facts which 
support the above conclusions, and these are related below: 

The forces on the Orbiter at breakup were probably too 
low to cause death or serious injury to the crew but were 
sufficient to separate the crew compartment from the for- 
ward fuselage, cargo bay, nose cone, and forward reaction 
control compartment. The forces applied to the Orbiter to 
cause such destruction clearly exceed its design limits. 

The data available to estimate the magnitude and direc- 
tion of these forces included ground photographs and 
measurements from onboard accelerometers, which were 
lost two-tenths of a second after vehicle breakup. 


42 Rogers Commission Report, Volume V. p. 1431. 
53 Ibid., Volume I, р. 180. 
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Two independent assessments of these data produced 
very similar estimates. The largest acceleration pulse oc- 
curred as the Orbiter forward fuselage separated and was 
rapidly pushed away from the External Tank. It then 
pitched, nose-down and was decelerated rapidly by aerody- 
namic forces. There are uncertainties in our analysis; the 
actual breakup is not visible on photographs because the 
Orbiter was hidden by the gaseous cloud surrounding the 
External Tank. The range of most probable maximum ac- 
celerations is from 12 to 20 G’s in the vertical axis. These 
accelerations were quite brief. In two seconds, they were 
below four G’s; in less than ten seconds, the crew compart- 
ment was essentially in free fall. Medical analysis indi- 
cates that these accelerations are survivable, and that the 
probability of major injury to crew members is low. 


After vehicle breakup, the crew compartment continued its 
upward trajectory, peaking at an altitude of 65,000 feet approxi- 
mately 25 seconds after breakup. It then descended striking the 
ocean surface about two minutes and forty-five seconds after break- 
up at a velocity of about 207 miles per hour. The forces imposed by 
this impact approximated 200 G’s, far in excess of the structural 
limits of the crew compartment or crew survivability levels. 

The separation of the crew compartment deprived the crew of 
Orbiter-supplied oxygen, except for a few seconds supply in the 
lines. Each crew member’s helmet was also connected to a personal 
egress air pack (PEAP) containing an emergency supply of breath- 
ing air (not oxygen) for ground egress emergencies, which must be 
manually activated to be available. Four PEAP’s were recovered, 
and there is evidence that three had been activated. The nonacti- 
vated PEAP was identified as the Commander’s, one of the others 
as the Pilot’s, and the remaining ones could not be associated with 
any crewmember. The evidence indicates that the PEAP’s were not 
activated due to water impact. 

It is possible, but not certain, that the crew lost consciousness 
due to an in-flight loss of crew module pressure. Data to support 
this is: 

The accident happened at 48,000 feet, and the crew cabin 
was at that altitude or higher for almost a minute. At that al- 
titude, without an oxygen supply, loss of cabin pressure would 
have caused rapid loss of consciousness and it would not have 
been regained before water impact. 

PEAP activation could have been an instinctive response to 
unexpected loss of cabin pressure. 

If a leak developed in the crew compartment as a result of 
structural damage during or after breakup (even if the PEAP's 
had been activated), the breathing air available would not have 
prevented rapid loss of consciousness. 

The crew seats and restraint harnesses showed patterns of 
failure which demonstrates that all the seats were in place and 
occupied at water impact with all harnesses locked. This would 
likely be the case had rapid loss of consciousness occurred, but 
it does not constitute proof. 

Much of our effort was expended attempting to determine wheth- 
er a loss of cabin pressure occurred. We examined the wreckage 
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carefully, including the crew module attach points to the fuselage, 
the crew seats, the pressure shell, the flight deck and middeck 
floors, and feedthroughs for electrical and plumbing connections. 
The windows were examined and fragments of glass analyzed 
chemically and microscopically. Some items of equipment stowed in 
lockers showed damage that might have occurred due to compres- 
sion; we experimentally decompressed similar items without con- 
clusive results. 

Impact damage to the windows was so extreme that the presence 
or absence of in-flight breakage could not be determined. The esti- 
mated breakup forces would not in themselves have broken the 
windows. A broken window due to flying debris remains a possibili- 
ty; there was a piece of debris imbedded in the frame between two 
of the forward windows. We could not positively identify the origin 
of the debris or establish whether the event occurred in flight or at 
water impact. The same statement is true of the other crew com- 
partment structure. Impact damage was so severe that no positive 
evidence for or against in-flight pressure loss could be found. 

Finally, the skilled and dedicated efforts of the team from the 
Armed Forces Institute of Pathology, and their expert consultants, 
could not determine whether in-flight lack of oxygen occurred, nor 
could they determine the cause of death.** 


E. SABOTAGE 


Issue 


Could the accident have been caused by sabotage, terrorism, or 
foreign covert action? 


Finding 
The Committee is convinced that there is no evidence to support 


sabotage, terrorism or foreign covert action in the loss of the Chal- 
lenger. 


Discussion 


The Committee carefully reviewed all of the evidence, classified 
and unclassified, to ensure that there was no sabotage associated 
with the loss of the Space Shuttle Challenger. 

Committee staff met with the Director of Safety, Reliability and 
Quality Assurance, and the Director of Protective Services and his 
Staff to review the National Resource Protection Plan for the Ken- 
nedy Space Center. The Committee is concerned with the vulner- 
ability of the Space Transportation System and endorses the efforts 
being taken by NASA to provide adequate protection to all ele- 
ments of the system. 


F. ADDITIONAL AVENUES OF INVESTIGATION 


Issue 


Could the accident have been caused by some failure other than 
failure of the joint between the casings? 


14 This memo was part of a package release, NASA, 86-100, draft, July 21, 1986. 


80 


Finding 

As of September 15, 1986, the Committee has not found any cred- 
ible evidence to support any cause of the Challenger accident, other 
than the failure of the aft casings joint in the right-hand Solid 
Rocket Booster. Nor has there been any substantial evidence of a 
secondary or parallel failure on Flight 51-L. 


Discussion 


After the accident, the Committee waited until the Rogers Com- 
mission completed its work in order not to interfere with the 
progress being made by the Commission appointed by the Presi- 
dent. By the time that work was completed the preponderance of 
evidence clearly pointed to a failure in the field joint of the right 
Solid Rocket Booster. However, the Committee was obligated to ex- 
plore other possibilities which could have led to the same type of 
failure. Among these possibilities were the following: a failure of 
the propellant, a structural flaw in the steel casing, and separation 
of the NBR insulation from the casing. In addition, the Committee 
was contacted by and sought additional testimony from private cit- 
zens who offered their concerns and hypotheses pertaining to the 
cause of the Challenger accident. These included the following: 
either a main engine fire or a fire in the main engine compartment 
of the Orbiter, inadvertent firing of an OMS engine, inadvertent 
firing of one or more thrusters on the Orbiter, overloading of the 
aft field joint due to excessive "moment" developed in transit of 
the Shuttle from the VAB to the launch pad and the use of four 
separate propellant casings instead of one large casing without 
field joints. 


1. Main Engine Fire 


The photographs in Volume I of the Rogers Commission report 
on pages 26 and 27 indicate a bright spot in the vicinity of the 
main engine compartment. Photographic evidence is customarily 
taken to be accurate. In this case, however, it must be realized that 
the photographs were taken from roughly three miles away and 
that they were enhanced by computer methods. Computer enhance- 
ment has the ability to highlight bright objects and subdue dull 
ones. In this way, the photographs become distorted, that is, the 
difference between light and dark becomes unrealistically pro- 
nounced. The bright spot in the photographs does, in fact, look like 
a flame. The second consideration is that the orientation between 
the Orbiter and the ground where the cameras were is difficult to 
visualize and leads to erroneous conclusions. During flight the 
main engines are monitored continuously for changes in pump 
speed, temperature and pressure. There was no indication whatso- 
ever of a malfunction with the main engines. A fire in the main 
engine compartment outside of the engines is not credible because 
of the lack of combustible material to support a fire of any appre- 
ciable magnitude. The exception would be a hydrogen leak. But, 
that was not supported by telemetry data. In addition, NASA has 
submitted photographs to the Committee from four past successful 
launches which show the same bright spots. The Committee, there- 
fore, has rejected this as a cause of the accident or as an independ- 
ent problem. 
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2. Independent Firing of the OMS Engine ог Orbiter Thrusters 


The theory that either the OMS engines or the Orbiter thrusters 
were inadvertently activated and fired is also based on the same 
photographs stated previously. Those photographs show a bright 
spot in the same general area where these engines and thrusters 
are. The Committee has received photographs from Flights 41-G, 
61-А, 61-13, and 61-C, all of which show similar “bright spots" in 
the same location as those seen on Flight 51-L. The Committee is 
still evaluating the possibility of a second failure in this regard and 
has requested additional telemetry data from Flight 51-L. Had the 
thrusters been firing, however, it would have had little impact on 
the launch of the Challenger. The thrust from these tiny engines is 
insignificant compared to the thrust from the two Solid Rocket 
Boosters and the main engines. The inadvertent activation of the 
OMS engine has been ruled out on the basis of telemetry data re- 
ceived from NASA. NASA has stated that the bright spot seen in 
the photographs is a reflection from the plume of the Solid Rocket 
Booster motors. Neither of these possibilities contributed to the 
Challenger accident. 


3. Overloading of the Joint 


It is true that in transit from the VAB to the launch pad, the 
Shuttle system, standing erect on the launch platform and being 
carried by a crawler, does experience a left-hand turn. At that 
time, because of the configuration of the Shuttle system, an addi- 
tional moment, that is force times a distance, is transferred to the 
field joints including the aft joint on the right-hand Solid Rocket 
Booster that failed. However, this moment exerts a force which is 
only 10 percent of the force that the joint receives during other 
phases of the launch operations. The Committee concluded that 
this had no impact on the Challenger accident. 


4. Insulation Debonding 


The Committee investigated the possibility of separation of the 
insulation from the inside of the motor casings as a potential cause 
of the Flight 51-L accident. Had the insulation broken lose from 
the casing, there would have to have been a condition which would 
have permitted the burning propellant gases to get between the in- 
sulation and the casing. Furthermore, there would have to be a 
continuous gas flow at that point for the propellant gas to transfer 
a sufficient amount of heat to the casing to cause a failure. This 
would require an extremely large debonding of the insulation 
which has never been seen on any Shuttle flight when the Solid 
Rocket Motors were returned and disassembled for use later. When 
the Shuttle motors were inspected after usage, what remained of 
the insulation has always been in place with little damage. A de- 
bonding accident would have had to provide tremendous amounts 
of heat and again would have required a very high flow of the gas 
into the area where the debonding occurred. That flow of gas would 
have to be continuous and there is no rationale for envisioning how 
that could happen. In the case of the Shuttle Solid Rocket Motor 
design, the pressure acts to maintain the bond between the insula- 
tion and the casing, not to remove it. In the absence of these re- 
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quirements the Committee found that debonding of the insulation 
was not a cause of the accident. 


5. Crack in the Propellant 


The Committee investigated whether or not a crack in the pro- 
pellant could have contributed to loss of the Challenger. A crack in 
the propellant would have increased the burning surface of the pro- 
pellant after ignition. This increase in the surface would have re- 
sulted in an increase in th thrust from the right Solid Rocket 
Motor. There was no evidence during the flight of 51-L of a greater 
thrust in the right Solid Rocket Motor. In additional, a propellant 
failure would have been more explosive in nature and would not 
have been observed as one continuous gas flame in a localized area. 
Consequently, it was concluded that a propellant failure did not 
contribute to the cause of the accident. 


6. Crack in Motor Casing 


The Committee was concerned that a crack in the rocket motor 
casings might have caused the accident if it was located in the 
same general area where the smoke and flame was observed during 
launch. АП of the casings used on Flight 51-L were hydroproofed 
at 1.1. maximum expected operating pressure. Had there been a 
signficant crack in the casing it would have failed the hydroproof 
test. However, it could be argued that a crack developed between 
the test and the time the Solid Rocket Motor segments were assem- 
bled at the Kennedy Space Center. The failure of cracks under the 
pressures, such as those contained within the Solid Rocket Motors, 
would have been a catastrophic failure. The casings would have 
failed instantly at ignition because cracks in high carbon steel 
would propagate at a rate near the speed of sound. This is incon- 
sistent with the smoke seen during the early part of the launch, 
and the lack of smoke or flame up until 58 seconds into the launch. 
It is also inconsistent with the pieces of the rocket motor casings 
which were recovered from the ocean which clearly show the abra- 
sion of the hot rocket propellant gases. Consequently, a crack in 
the casing was ruled out as a contributing cause of the accident. 


7. Joint putty temporarily holds and then releases full motor 
pressure 


During the post-accident tests conducted by NASA and Thiokol, 
it was learned that the performance of the putty used in the joint 
can be quite variable. In some instances, including temperatures as 
warm as 75°F, the joint putty can hold back the full operating pres- 
sure inside the motor without transferring any of this pressure to 
the O-rings.*5 In this circumstance, the O-rings will not "seat" and, 
as the joint "rotates" due to the pressure build-up within the 
motor, contact can be lost between the O-rings and the metal sur- 
faces they are meant to веа1.46 If the putty were then to release 


55 Rogers Commission Report, Volume I, p. 64. 
46 NASA, briefings from staff. 
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high pressure gases into the joint, these gases could “blow-by” the 
O-rings, thus causing the joint to fail. This scenario is not a likely 
failure mode for STS 51-L, because it would produce a leak across 
a broad area of the joint rather than a small localized leak as ob- 
served in the Challenger accident. 


VI. DISCUSSION OF CRITICAL ISSUES 
A. TECHNICAL IssuES 


1. HARDWARE DEVELOPMENT AND PRODUCTION 
a. Problems in Hardware Certification 


Issue 1 


Having all elements of Space Shuttle flight hardware been ade- 
quately certified? 


Findings 


1. The overall design and certification processes prescribed by 
NASA for each major element of Space Shuttle flight hardware are 
very comprehensive. 

2. Prior to the STS 51-L accident, in spite of the comprehensive 
nature of NASA’s prescribed design and certification processes, in- 
sufficient testing had been conducted to permit an adequate under- 
standing by either Morton-Thiokol or NASA regarding the actual 
functioning of the Solid Rocket Motor joint. Also, the Solid Rocket 
Motor had not been adequately certified to meet the natural and 
induced environmental conditions that are stated in NASA’s design 
standards. The issue of whether or not standards were adequate is 
discussed in Section VII. 

3. The deficiencies in Solid Rocket Motor testing and certifica- 
tion persisted in spite of many reviews of the program by panels of 
experts: (1) within the manufacturer; (2) within NASA; and (3) from 
independent, outside groups. 

4. These deficiencies in testing and certification of one major ele- 
ment of the Space Shuttle system raise the possibility that other 
elements of flight hardware (or other subelements of the Solid 
Rocket Motor) could have similar deficiencies. 

5. If NASA is unable to explain why the deficiencies in Solid 
Rocket Motor testing and certification went undetected by the ex- 
isting comprehensive set of processes and procedures, the agency 
will not be able to protect against a similar break-down in its 
system of checks and balances in the future. 


Recommendations 


1. NASA should devote more attention to determining why the 
deficiencies in Solid Rocket Motor testing and certification went 
undetected, so that appropriate action can be taken to uncover 
latent problems in existing hardware and to prevent similar prob- 
lems in future development programs. 

2. NASA and its contractors should thoroughly reassess the ade- 
quacy of all of the testing and certification that has been conducted 
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to date on each element of Space Shuttle flight hardware. Where 
deficiencies are found, they must be corrected. 


Discussion 


In background briefings for the Committee staff prior to the start 
of the hearings, NASA described the system of formal reviews that 
were employed to scrutinize the design and certification of each 
element of flight hardware. 

The review process began with a System Requirements Review in 
the early 1970’s. About 18 months later, each hardware element 
went through a Preliminary Design Review (PDR). This review was 
conducted when about 10 percent of the engineering drawings were 
complete and resulted in approval for the hardware to move into 
the final design stage. The Critical Design Review (CDR) was held 
when about 90 percent of the engineering drawings were complete 
and resulted in an authorization to carry the manufacturing proc- 
ess through to completion. After the end of a detailed test and cer- 
tification program, NASA conducted a Design Certification Review 
(DCR) to ensure that all tests and certification results were consist- 
ent with specified design requirements and standards. 

Because of the extreme complexity of the Orbiter, a series of 
Configuration Acceptance Reviews (CARs) was also conducted in 
addition to the standard process of reviews described above. The 
Phase I CAR was a verification review to ensure that the Orbiter 
was ready to begin test. Prior to the start of the Orbiter combined 
system test, several additional incremental test reviews were also 
conducted. The Phase Ш CAR was the verification review that re- 
sulted in final acceptance of the vehicle for delivery from the man- 
ufacturer to NASA. 

In Appendix K in Volume II of the Rogers Commission Report, 
the Development and Production Team discusses in further detail 
the design and certification processes that were used by each prime 
contractor. For example, this appendix indicates that Rockwell 
used a total of 17 design review teams (some divided into as many 
as 17 subteams) to oversee the design and production work on the 
Orbiter. The appendix also describes the requirement verification 
system used by Thiokol for the Solid Rocket Motor as a “closed- 
loop” system intended to track each specification requirement. The 
system specified the method of verification (analysis, inspection, 
test, etc.) that was to be used for each program phase (develop- 
ment, acceptance, prelaunch, etc.), along with all applicable re- 
quirements of the verification plan. These were tracked through 
the test plans and reports and then culminated in the issuance of a 
formal "certificate of qualification". ! 

In addition to this comprehensive system of oversight and review 
by each prime contractor and each NASA field center responsible 
for monitoring the work of those contractors, detailed outside re- 
views of the design and testing programs for each major element of 
flight hardware also occurred. For example, the Aerospace Safety 
Advisory Panel regularly reviewed the safety aspects of Space 
Shuttle flight hardware and annually reported their concerns to 


1 Rogers Commission Report, Volume П, pp. K-12 and K-28. 
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the NASA Administrator.2 As another example, NASA Headquar- 
ters in 1980 created a Space Shuttle Verification/Certification 
Committee to thoroughly study the flight worthiness of the entire 
Shuttle system.? This independent committee was chaired by Dr. 
Walt Williams, NASA’s Chief Engineer, and was comprised of rec- 
ognized experts drawn from the military, private industry, and aca- 
demia. There was also additional reviews such as a study of the 
pace Shuttle Main Engine conducted by Professor Gene Covert of 
4 

Finally, before the first flight of the Space Shuttle in 1981, 
NASA had each contractor and each field center carefully review 
all of the requirement specifications and certification tests for their 
flight hardware to ensure that all contract end-item requirements 
had been adequately certified. Upon determining that all certifica- 
tion requirements had been satisfied, each NASA project and tech- 
nical manager was requried to sign a Verification Completion 
Notice (a copy of which is contained in Appendix VI-A of this 
report). This entire process was then duplicated prior to the first 
“operational”’ flight of the Space Shuttle (i.e., STS-5 in 1982). This 
latter process also culminated in each NASA project and technical 
manager signing a second Verification Completion Notice (a copy 
of which is contained in Appendix VI-A of this report.). 

Given this comprehensive system of reviews, it is difficult to un- 
derstand how major inadequacies in design and certification for 
any element of flight hardware could have gone unnoticed. But it 
is exactly what happened for the Solid Rocket Motor. Specifically, 
the Commission concluded that: 


The joint test and certification program was inadequate. 


And, 


Prior to the accident, neither NASA nor Thiokol fully 
understood the mechanism by which the joint sealing 
action took place. 


In addition, the Development and Production Team concluded that: 


Prior to the STS 51-L accident, there was a lack of un- 
derstanding on the part of MTI [Morton Thiokol Inc.] and 
NASA of the joint operation as designed. 


And, 


JSC 07700, Volume X [the NASA master requirements 
document for the Space Shuttle program], clearly states 
the natural and induced environments to which the SRM 
[Solid Rocket Motor] is to be designed and verified. The 
field joints . . . were not qualification tested to the full 
range of the contractually required environments. This led 
to a lack of complete understanding of the joint design 
limits.® 


2 Ibid., Volume І, рр. 160-161. 
3 [bid., рр. 124-125. 

4 Ibid., Volume П, p. K-24. 

5 Ibid., Volume I, р. 148. 

в Ibid., Volume II, p. K-30. 
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Relative to this last point, the NASA requirement documents 
state that: “The Shuttle Flight Vehicle design shall satisfy the nat- 
ural environmental design requirements . . .”, including air tem- 
perature extremes of 20°F to 103°F at "Ferry Sites" and 31°F to 
99*F for "Vertical Flight". Also, the requirement documents state 
that: "Each element of the Shuttle Flight Vehicle shall be capable 
of withstanding the induced environments imposed during trans- 
portation, ground operations, handling and flight operations . . .", 
including induced Solid Rocket Booster surface temperatures as 
low as 25°F and induced temperatures as low as 21°F at the point 
where the aft strut attaches the Solid Rocket Boosters to the Exter- 
nal Tank. (Excerpts documenting these temperature requirements 
are contained in a briefing given by NASA to Joseph Sutter of the 
Rogers Commission on May 19, 1986, which is reproduced in Ap- 
pendix VI-A-4 of this report.) 

Of principal concern to the Committee is the fact that none of 
the extensive systems of checks and balances within the Space 
Shuttle program discovered the lack of adequate testing and certifi- 
cation of the Solid Rocket Motor. This failure of the management 
and review system indicates to the Committee that other elements 
of Shuttle flight hardware or other subelements of the Solid Rocket 
Motor may also be inadequately understood or certified. This will 
obviously require NASA and its contractors to conduct a careful 
review of all the testing and certification efforts that have been 
conducted to date for each element of Space Shuttle flight hard- 
ware. 

A parallel concern of the Committee is that NASA does not yet 
know how or why this break-down occurred in this comprehensive 
system of reviews, checks, and balances. Without such an under- 
standing, the teams that will now be conducting the required re- 
views of each element of flight hardware will be somewhat disad- 
vantaged because they cannot be certain that they are "asking the 
right questions" or "looking for the right things." Further, without 
an understanding of how and why the existing management and 
control system broke down, NASA will not be able to make the 
necessary managerial and procedural changes required to be confi- 
dent that this problem will not reoccur in the future. 


Issue 2 


Does the Space Shuttle Main Engine have adequate operating 
margins, and is the “fleet leader" concept adequate to ensure safe 
operation? 

Findings 

1. The Space Shuttle Main Engine is an impressive technological 
achievement. However, it also is one of the higher risk elements of 
the Space Shuttle system. Anomalous component performance or 
premature engine shutdown could prove catastrophic to the Space 
Shuttle and its crew. 

2. Some NASA officials familiar with the Space Shuttle Main 
Engine believe that it should be operated at a throttle setting of 
109 percent only in an emergency; others believe the engine could 
be safely operated at 109 percent on a routine basis. 
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8. It is widely accepted that the Space Shuttle Main Engine 
would be safer if its operating margins (for temperature, pressure, 
operating time, etc.) were increased. 

4. The Committee agrees with the sense of Dr. Feynman’s con- 
cerns with respect to NASA’s current, “fleet leader” concept for 
certifying Space Shuttle Main Engine components, such as high 
pressure turbopumps, for flight. 

5. On a case by case basis, NASA regularly violates its own certi- 
fication requirements by permitting individual engine components 
to be used for flight even though they have accumulated an operat- 
ing time in excess of 50 percent of the two fleet leaders (i.e., in vio- 
lation of the “2X” rule). 


Recommendations 


1. NASA should continue its active development program for the 
Space Shuttle Main Engine. The program should be focused more 
on increasing operating margins. 

2. Because of the safety concerns raised by some knowledgeable 
officials, NASA should give serious consideration to restricting use 
of the 109 percent engine throttle setting to emergency situations 
only. If NASA decides that it needs to use the 109 percent throttle 
setting for other than emergency situations, the space agency 
should take whatever actions are required to ensure that adequate 
margins are present to maintain safety. 

3. NASA should closely scrutinize each of the concerns raised by 
Dr. Feynman regarding the agency’s “fleet leader’ concept for cer- 
tifying Space Shuttle Main Engine components. The agency should 
also closely reassess its practice of selectively violating its “2X” 
rule for some Main Engine flight hardware elements. 


Discussion 


The Space Shuttle Main Engine is, very appropriately, described 
by the Development and Production Team as a “high technology, 
high power density, state-of-the-art rocket engine."7 Indeed, the 
Space Shuttle Main Engine represents a major increase in operat- 
ing performance over that provided by any other available rocket 
motor. In his paper Dr. Feynman notes that the Main Engine “18 
built at the edge of, or outside of, previous engineering experi- 
ence." 8 The Development and Production Team also observed that 
the Space Shuttle Main Engine is “а very complex and high risk 
element of the Space Shuttle system." 9 

It is this last observation that is of more concern here. Specifical- 
ly, if the Space Shuttle Main Engine were to experience a major 
problem in flight, the results could be catastrophic. Even prema- 
ture engine shutdown could prove fatal during certain segments of 
flight because it would mean that the Orbiter would have to ditch 
at sea—a maneuver that the Rogers Commission concluded would 
probably be non-survivable.!9 


7 Rogers Commission Report, Volume II, p. K-3. 
4 5-8 р. Ё-2. 
? Ibid., р. K-3. 
19 [bid., Volume І, р. 182. 
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Therefore, the key question is: how safe is the Space Shuttle 
Main Engine? An informal review of failures that have occurred 
during ground testing over the past five years was reported to the 
Committee staff.!! It concluded that five of these failures would 
probably have been catastrophic if they had occurred in flight.!? It 
is also of note that each of these failures occurred at an engine 
thrust setting of 109 percent or greater. However, closer examina- 
tion of the cause for each failure indicates that most were the 
result of: poorly installed test instrumentation (engine 2208); an im- 
properly tested "fix" to an engineering problem (engine 2013); the 
use of "deactivated" components because no others were available 
(engine 0204); or the existence of a phenomenon that cannot recur 
because of the adoption of a new safety “теа line" in current flight 
engines (engine 0108) Тће failure of engine 2308, on the other 
hand, did uncover a life limit on current engine hardware. That 
particular engine had accumulated about 20,000 seconds of oper- 
ation (the equivalent of 40 Space Shuttle missions) in the compo- 
nent which failed (the main combustion chamber). Further, this 
engine had reportedly logged a significant amount of operating 
time at a power level of 109 percent. 

However, the question of engine safety still remains. The majori- 
ty of present and past Space Shuttle Main Engine program officials 
who briefed the Committee staff were personally uneasy at the 
thought of operating the Main Engine at a thrust setting of 109 
percent in anything other than an emergency situation. Specifical- 
ly, in certain emergency or abort situations, the throttle must be 
advanced to 109 percent to either reach orbit or to successfully 
return to the launch site. Under these circumstances, the risks of 
not using the 109 percent throttle setting (and having to ditch the 
Orbiter at sea) would obviously be greater than the risks of using 
that throttle setting. These officials also noted that, at the outset of 
the Main Engine development program, the 109 percent power set- 
ting was referred to as the "Emergency Power Level". As the pay- 
load lift performance of the Space Shuttle became increasingly 
marginal, however, the 109 percent setting was redesignated as the 
*Full Power Level." Subsequently, several engines were ground 
tested at the 109 percent power setting for a sufficient duration to 
certify use of that power setting in normal launch operations. 

In addition to Space Shuttle Main Engine program officials at 
NASA, others have expressed concern with using the 109 percent 
throttle setting. For example, the Aerospace Safety Advisory Panel 
voiced concern that “each time NASA flies at 109% we are really 
pushing the capability of the engine".!? In his testimony before the 
Committee, Mr. George Jeffs, President of Rockwell International 
(manufacturer of the engine) conceded that: 


... we don't have a lot of margin at 109 percent... . To 
be comfortable . . . we would recommend that we go to a 


11 Discussions with personnel from Rocketdyne, Pratt & Whitney, and Aerojet General, 
August, 1986. 

12 These include the destructive failures of engine 0204 in September 1981; engine 2013 in 
April 1982; engine 2208 in August 1982; engine 0108 in February 1984; and engine 2308 in 
March 1985. 

13 Discussion with Aerospace Safety Advisory Panel, May, 1986. 
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larger throat . . . and that we also add to that the dual 
manifold gas system... .” 14 


All observers agree that the "wear and tear" on an engine oper- 
ating at 109 percent is substantially greater than when it operates 
at the more standard 100 to 104 percent throttle settings. However, 
some NASA officials believe that the successful completion of a tra- 
ditional certification program involving two engines operating at 
109 percent thrust levels is adequate justification for use of the 109 
percent power setting for standard missions involving heavy pay- 
loads. Other officials, on the other hand, continue to believe that 
this power setting should be used only in emergencies. If this latter 
view is adopted, it would mean that the heaviest payloads now 
planned for launch by the Space Shuttle would have to be moved to 
expendable launch vehicles. The Committee is not now in a posi- 
tion to accurately predict the programmatic ramifications of such a 
decision, but the recent national commitment to an enhanced ex- 
pendable launch vehicle fleet could possibly minimize the negative 
impacts of a decision to restrict Space Shuttle Main Engine thrust 
levels to no more than 104 percent. 

Though there is substantial disagreement whether or not the 
Space Shuttle Main Engine should be used routinely at a thrust 
setting of 109 percent, there is little or no disagreement that the 
Main Engine would be safer if its operating margins (for tempera- 
ture, pressure, operating time, etc.) were increased. Indeed, the De- 
velopment and Production Team noted in its report that one of the 
formal actions being taken by Rocketdyne in response to the STS 
51-L accident is the creation of a "Margin Improvement Board." 15 
This board will review and suggest appropriate actions on all rec- 
ommendations for increased engine operating margins. 

Another concern that has been raised regarding the certification 
of the Space Shuttle Main Engine relates to NASA's use of the 
“fleet leader" concept. NASA's basic engine certification guidelines 
require that all components be tested on the ground in two engines 
for a period of time at least twice as long as the time that those 
components will accumulate in flight. For example, before turbo- 
pumps can be used for four successive flights, the turbopumps in 
two ground test engines must be tested for the equivalent time that 
would be required to accomplish eight successive flights. Dr. Feyn- 
man cites several problems with this approach. These include: 


The question of what constitutes an “unsuccessful” test? 
To the Federal Aviation Administration, a cracked turbine 
blade would constitute a failed test. To NASA, on the 
other hand, a turbine blade would not be considered to 
have "failed" until it actually broke in two.!$ 


14 Hearings before the House Science and Technology Committee, “Investigation of the Space 
Shuttle Challenger Accident," 99th Cong., 2nd Sess., Transcript, July 15, 1986, p. 13. (Hereafter 
referred to as Cmte Hgs). 

15 Rogers Commission Report, Volume II, p. K-27. 

16 After further investigation, the Committee has learned that some qualifying remarks are 
required for Dr. Feynman’s characterization of the FAA engine qualification procedures to be 
totally accurate. The FAA does not permit cracks in what it calls “critical” engine components. 
However, cracks located at, or above, the base of a turbine blade are not considered critical by 
the FAA because: (1) commercial jet engines possess adequate internal shielding to contain any 

Continued 
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The question of whether two “fleet leader” engines гер- 
resent a better indication of component operating life than 
a third engine which fails in a lesser time? In other words, 
should the operating time limits for flight hardware be set 
at one-half that of the two fleet-leader engines or one-half 
that of the shortest-lived components? 

When a defect is found in a fleet leader engine and a 
component must be replaced, what engine running time 
should be used for calculating permissable flight hardware 
operating times for that component using the “2Х” rule: 
(1) the accumulated operating time up to the start of the 
final test; (2) the accumulated time as of the end of the 
final test; or (8) some length of time in between these two 
extremes? 17 


In the staff review prior to the Committee hearings, NASA offi- 
cials also noted that the agency frequently violates its “2Х” rule 
for engine flight hardware—permitting components to be used in a 
particular mission that have not been tested on the ground for 
twice as long as their intended use in flight. However, these offi- 
cials noted that this was only done on a “сазе by case basis” and 
only for those components that are considered to be highly reliable. 

Possibly the most disturbing observation regarding the Space 
Shuttle Main Engine made by Dr. Feynman in his report is his as- 
sertion that: “the Flight Readiness Reviews and certification rules 
show a deterioration for some of the problems of the Space Shuttle 
Main Engine that is closely analogous to the deterioration seen in 
the rules for the Solid Rocket Boosters.” If true, this assertion is 
obviously quite ominous. 18 


b. Recurrent Hardware Problems 


Issue 1 


What resolutions of inadequacies revealed in the landing gear, 
tires, wheels, brakes, and nose wheel steering of the landing and 
deceleration system are required? 

Findings 

1. The Orbiter landing gear, tires, wheels, brakes, and nose 
wheel steering, as a system, is experimental, designed to criteria 
outside any other experience, and uses unique combinations of ma- 
terials. The original design performance specifications for speed 
and landing weights are routinely exceeded. The original design 
did not consider asymmetrical braking for cross wind steering аз 
the normal case although it has become standard practice. Stresses 
which were not taken into account in the design have surfaced in 
as yet a very small real world sample. 


broken blades totally within the engine; and (2) all commercial jet aircraft are designed to fly 
with one engine inoperative. On the other hand, the FAA does consider as critical any cracks in 
the “fir tree" region of a turbine blade which is used to attach the blade to the hub of the tur- 
bine. (Should a turbine blade break in this region, it may be heavy enough to break through the 
engine — This is the region in which cracks аге appearing in воте Space Shuttle Main 
Епріпе turbine blades. 

17 Rogers Commission Report, Volume II, р. Е-3. 

18 [bid. 
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2. Ав a consequence, Orbiter landings appear high risk even 
under ideal conditions, which seldom occur. Exceptional procedural 
and skill demands are placed upon the pilots to nurse the brakes 
and tires through every landing. Landing rules have had increas- 
ing constraints imposed that hamper operational flexibility and 
usefulness of the Orbiter. 

3. Brake and tire damage have been evident since early on in 
the program. The Rogers Commission seems very correct in finding 
the current landing gear system unacceptable. Resolution of land- 
ing gear system problems can no longer be put off. 


Recommendations 


The Committee recommends that NASA: 

1. Assemble all of the fragmented studies, analyses, and conclu- 
sions on landing gear problems and integrate them into one engi- 
neering description of the system as it is now intended to be used. 
This should include consideration of the basic strength of the struts 
themselves and their attachments. 

2. Write a new system specification and match the proposed 
design improvements to an acceptable reliability and certification 
specification. 

3. Design a test and certification program adequate to meet cri- 
teria to fly and to continue well into future operations until under- 
standing and confidence in the landing gear system is attained. 

4. In anticipation of requirements for a new brake specification, 
accelerate a program to provide: 

Increased brake mass and/or heat sink; 

Substantial increase in energy absorption; 

Evaluation which weighs the experimental nature of the pro- 
posed 65 million foot pound carbon brake and its impact on the 
system against the penalty of weight of known materials (e.g. 
steel) for operational confidence. 

5. Write updated subsystem specifications to upgrade the landing 
gear system to acceptable levels of performance to respond to the 
Rogers Commission’s recommendations. 


Discussion 


The sheer volume of testimony and documentation inevitably 
gives rise to apparent contradictions. None have surfaced that are 
assessed as consequential in evaluating the landing gear system 
problems (NASA’s “‘anomalies’’) with a view to their solution. 

The main landing gear (see Figure VI-1) consists of two heavily- 
loaded, two-wheel struts with two brakes on each and is designed 
for deceleration only. Roll-out and cross-wind steering correction 
was originally assigned to the nose wheel steering for the normal 
case. Each tire, wheel, and brake is supported by redundant fail 
operational anti-skid brake actuators, control valves, control boxes, 
and hydraulic power. 

The nose wheel strut has two wheels on a common axle, no 
brakes, and is steerable. At the time of the accident nose wheel 
steering was not permitted except in an emergency because it did 
not have fail operational or fail safe redundancy. This places addi- 
tional requirements on the main gear braking system that were a 
substantive source of main gear problems. Need for correction of 
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this oversight was most apparent and is the simplest of several dif- 
ficult landing gear problem solutions. The lack of definitive action 
in five years of operations is not explained. 

The tires apparently meet all of their design specifications but 
are critical for other reasons: (1) If a tire is soft or flat at the time 
of the nose down load spike (caused by negative lift on the wing, 
when the nose wheel makes contact) the other tire on that strut 
will take loads far in excess of its 130,000 pound limit and fail. (2) 
There is a body of opinion that at almost any time in the landing, 
one failed tire will assure the failure of its mate. (3) There is no 
assurance at launch that there is adequate pressure in any of the 
tires to assure spec performance. (3) Scuffing, cutting, abrading, 
and wear from spin up, asymetrical braking (cross wind steering), 
surface roughness, and debris have been more than expected and 
disallow reuse of most tires (one landing per tire was spec). (4) 
Anti-skid becomes inactive at 20 knots and damaged brakes will 
lock up and blow both tires. It would appear that solving a host of 
other problems will resolve a number of the major tire problems. 

The brakes by all standards are very large, very light, of conven- 
tional configuration, and very experimental because of extensive 
stretching of materials technolgy by using carbon-beryllium. Brake 
design is not rigorous, it is very empirical and results are often un- 
predictable in new designs. The Orbiter brakes incorporate berylli- 
um stators and carbon lined beryllium rotors. Beryllium has low 
density, high strength, and high heat capacity. Beryllium is very 
tender and not well behaved at high temperatures. Beryllium has 
unreliable plastic characteristics at higher temperatures. Use of be- 
ryllium in lieu of steel saved perhaps 1000 pounds in the cumula- 
tive landing gear weight. The C-5A aircraft uses beryllium rotors 
and stators. 
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For the first 23 Orbiter flights, brake damage occurred to уагу- 
ing degrees on 15 flights for a sum of 32 damaged brakes. Failure 
seemed to favor the right hand gear. A great majority of these 
damages were not necessarily associated with heavy demands. A 
very few were caused by approaching the design energy absorption. 
A case cannot be made against the heavy footed pilot. Regression 
analysis indicates that there are no significant trends that show 
brake damage is a function of energy demands within limits, peak 
demands, or landing weight. It appears that the brakes, relieved of 
asymmetric steering loads, will approach design energy absorption 
specifications for one landing but those specs are inadequate to cur- 
rent requirements for repetitive operations. 

The primary source of failure is cracking and fragmentation 
damage arising from hot spots and chatter or dynamic loads from 
vibrations. It was conjectured that these can be worse if the brake 
is lightly used (“not tightly clamped”). The pilots were given the 
astounding instructions to never release a brake once applied be- 
cause if the brake is reapplied the loose fragments will destroy it 
and cause seizure.!? 

From the history unfolded to the Commission and Committee in- 
vestigation, it is not difficult to understand why the landing gear 
system is marginal in today’s operation. The original Orbiter 
design criteria were quite different and are in part: 


System Original Orbiter Current Orbiter 
Drogue сПибе.............................................. Primary Чесеегаб0п..................................... Deleted. 
Nose wheel steering .................................... Asymmetric loads........ Delete-emergency only. 


Tires sse One landing per tire... Same. 
Landing weight, abort (worst case) ........... 225,000 Ib.................. 240,000 Ib. 
Lightweight wheel һгаКе$............................ Emergency, drogue back up and final Primary deceleration and stop. 
deceleration. 
Wheel brake life .......................................... 5 landings dynamometer certified ................ Same. 
(Typical: 
Bombers... аа ааа 40 landings. 
Airlitiel's.............. tees 100 landings 
5 max landings. 
1 emergency. 


(all without thrust reversal). 


The whole operational load to decelerate, stop, and steer fell on 
what was originally the emergency backup brake system. The five 
landing design is impossible to fine tune to that degree and may 
yield only a design of imminent failure. It follows that every land- 
ing with the now increased normal and abort landing weights is an 
engineered emergency. How much the increased demands and 
weight have intruded into the landing gear strut design factor of 
safety and margin are unknown, but certainly a concern. 

In summary, weight savings and inability to retrofit (i.e. larger 
tires and/or brakes) collided with the then state of the art result- 
ing in the normal high risk of landing being compounded. It is a 
tribute to the pilots that they were able to carry such a tender 
system this far. Redundancy of tires and wheels has never been 


19 Rogers Commission, "Meeting of Challenger Commission; NASA, JSC", Halloway, T. et al., 
March 9, 1986, p. 313; and Bobko, K. et al., March 24, 1986, p. 152. 
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design practice. A successful landing could be made with both tires 
and brakes gone from one side with a steerable nose wheel and la- 
terial stability from the opposite truck, if on a hard surface (con- 
crete). The lake bed and stabilized overrun zones would probably be 
another matter. 

Testimony implies that full-time nose wheel steering and higher 
capacity brakes are a top priority requirement for return to oper- 
ations. Reference is made several times to a replacement 55 million 
foot pound all carbon brake in lieu of the 42 million foot pound 
carbon-beryllium brake. Rockwell International gave testimony 
that a 65 million foot lb. brake was in work.?? To maintain the 
equivalent BTU’s per pound, the carbon brakes must peak at much 
higher temperatures. This poses a new stress on the temperature 
environment of the tires and wheels. Carbon brakes used on the 
Concorde, B747, 757, 767 and C-5B are said to be experiencing dy- 
namic failure modes. Carbon brake design has a better data base to 
work from than the beryllium but such a new brake will continue 
to be experimental and developmental in nature in the Orbiter ap- 
plication. 


Issue 2 


What actions should be taken relative to other recurrent prob- 
lems with flight hardware? 


Finding 
There have been many instances of in-flight anomalies and fail- 
ures of other elements of Space Shuttle hardware, some involving 


mission critical pieces of equipment. Some of these past problems 
have been corrected while others have not. 


Recommendation 


NASA should ensure that before reinstituting Space Shuttle 
flight operations, it fully understands and has corrected all in- 
stances of serious in-flight anomalous behavior or failures involv- 
ing mission critical pieces of flight hardware. 


Discussion 


Throughout the Space Shuttle program, there have existed a 
number of recurrent hardware problems in addition to those dis- 
cussed elsewhere in this report. Some have already been solved. 
For others, new hardware has been ordered that hopefully will re- 
solve the problem, while still other problems remain unsolved. 
Listed below are some examples of recurrent problems that have 
occurred with elements of Space Shuttle flight hardware: 

Anomalous behavior of Space Shuttle Main Engine hydraulic 
actuators—on two occasions (STS-41D and STS-51F). This re- 
sulted in engine shutdown just prior to liftoff. 

Numerous instances of failure of temperature and pressure 
sensors within Space Shuttle Main Engines—in one case (STS- 
51Е) this resulted in the premature shutdown of a good engine 


20 Cmte Hgs, Transcript, July 15, 1986, p. 9. 
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during flight.?! (During some periods of the launch phase, this 
could result in ditching of the Orbiter at sea, with probable 
catastrophic results.) 

Frequent occurrence of cracks in turbine blades and sheet 
metal parts of Space Shuttle Main Engines, requiring that 
engine components be replaced often. 

Nonconsistent erosion performance of Solid Rocket booster 
nozzles—with one instance (STS-8) nearly resulting in a poten- 
tionally disastrous "burn through". 

Evidence of damage to Solid Rocket Booster nozzle O-rings in 
18 the 23 missions for which the booster sets were гесоу- 
ered.?? 

Malfunctions in the Solid Rocket Booster recovery system 
(e.g., parachutes)—with one occurrence (STS-4) resulting in the 
loss of a flight set of Solid Rocket Boosters. 

At least 48 instances of anomalous inflight behavior of the 
Auxiliary Power Units that drive the Orbiter's flight controls 
during launch and landing.?? In one case (STS-9), two auxilia- 
ry power units failed during landing, shutdown, and then ex- 
ploded several minutes after the Orbiter had come to a stop on 
the runway. 

Anomalous behavior or total failure of the General Purpose 
Computers on the Orbiter. 

Ejection of thermal insulation from the "іпіегіапК" region 
of the External Tank (ie. the region between the liquid 
oxygen and liquid hydrogen tanks), causing tile damage on the 

rbiter. 

Failures in the Orbiter’s Thermal Protection System, includ- 
ing the loss of tiles, the disconnection of thermal blankets, and 
chemical decomposition of the “screed” layer beneath many 
tiles on the Orbiter Challenger. 

At least 63 instances of anomalous inflight behavior of the 
Reaction Control System that controls the flight orientation of 
the Shuttle while in orbit and during the initial stages of re- 
entry.?* 

At least 78 cases of anomalous inflight behavior of the com- 
munications and tracking equipment on board the Orbiter.?5 

Clearly, some of these problems are more serious than others, 
and as noted earlier, some have been solved. However, the Commit- 
tee is mindful of the conclusion of the Rogers Commission regard- 
ing the existence of similar situations for the Solid Rocket Motor 
prior to STS 51-L: “а careful analysis of the flight history of O-ring 
performance would have revealed the correlation of O-ring damage 
and low temperature." ?9 Also referring to Criticality I flight hard- 


21 The two events mentioned in this and the preceding paragraph involving Main Engines on 
STS-51F were separated by 17 days, with the Is abort due to an actuator failure occurring on 
July 12, 1985, and the inflight abort due to a double thermocouple failure occurring on July 29, 
1985 


22 Rogers Commission Report, Volume I, pp. 129-31. 

?3 NASA, "Shuttle Flight Data and аи Anomaly List, Revision Н,” Johnson Space 
Center, Houston, Texas, January, 1986, pp. 2-8 and 2-9. 

24 Ibid., pp. 2-6 and 2-7. 

25 [bid., рр. 2-16 and 2-17. 

26 Rogers Commission Report, Volume I, p. 148. 
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ware elements, the Commission recommended that, "NASA should 
establish a system of analyzing and reporting performance trends 
for such items.” 27 

In a similar vein, Dr. Feynman observed: 


The argument that the same risk was flown before with- 
out failure is often accepted as an argument for the safety 
of accepting it again. Because of this, obvious weaknesses 
are accepted again and again, sometimes without a serious 
attempt to remedy them, or to delay a flight because of 
their continued presence. 


And, 


The acceptance and success of these (previous) flights is 
taken as evidence of safety. But erosion and blow-by are 
not what the design expected. They are warnings that 
something is wrong. The equipment is not operating as ex- 
pected, and therefore there is a danger that it can operate 
with even wider deviations in this unexpected and not 
thoroughly understood way.?8 


In the spirit of these observations, it would seem clear that 
NASA should make sure that it fully understands all past in- 
Stances of inflight anomalies and failures involving critical ele- 
ments of hardware. Then, when appropriate, NASA should correct 
the underlying causes of these anomalies and failures. 


c. Other Engineering Concerns 


Issue 


What action should be taken relative to other engineering con- 
cerns regarding critical elements of Space Shuttle flight hardware? 


Finding 
In recent years, serious engineering concerns have been raised 
regarding the safety of some elements of Space Shuttle flight hard- 


ware, such as the 17 inch flapper value and the heat exchanger 
feeding the liquid oxygen tank. 


Recommendation 


1. NASA should ensure that, as a part of its current review of 
Space Shuttle safety, it identifies, thoroughly evaluates, and then 
takes appropriate action on all serious engineering concerns raised 
regarding mission critical elements of Space Shuttle flight hard- 
ware. 

2. NASA should give special attention to both the cost and risks 
of using Filament Wound Case Solid Rocket Boosters for very 
heavy Space Shuttle payloads versus the cost and programmatic 
impacts of simply transferring those payloads to expendable launch. 
vehicles. 


27 Ibid., p. 201. 
28 Ibid., Volume П, p. F-1. 
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Discussion 


In the months since the Challenger accident, there has been re- 
newed interest in scrutinizing engineering concerns that have been 
raised in recent years regarding the safety of some elements of 
Space Shuttle flight hardware. Typical examples of some of these 
concerns involve the following pieces of equipment: 

The 17 inch “flapper valves” on the fuel lines between the 
External Tank and the Orbiter. The inadvertent closing of one 
of these valves before Main Engine shutdown could be cata- 
strophic, causing a rupture of a fuel line and/or the External 
Tank. Failure to close after engine shutdown, on the other 
hand, could cause the External Tank to crash into the Orbiter 
after being jettisoned. 

The heat exchanger used to produce gaseous oxygen to pres- 
surize the liquid oxygen tank in the External Tank. This heat 
exchanger is located inside one of the turbopump preburners of 
the Space Shuttle Main Engine. Should a rupture occur in the 
wall of the heat exchanger, high temperature hydrogen gas 
could be driven into the liquid oxygen tank or additional 
oxygen could be driven into the preburner—either situation 
could be catastrophic. A solution to this problem could be to 
move the heat exchanger outside of the Main Engine, possibly 
using the engine’s hydrogen cooling jacket as a source of heat 
to produce the required gaseous oxygen. 

The Filament Wound Case version of the Solid Rocket Boost- 
er now under development for use in launches involving very 
heavy Space Shuttle payloads. The Aerospace Safety Advisory 
Panel argues that this system may have questionable structur- 
al strength safety margins in the transition areas between in- 
dividual case segments.?? Safety concerns such as these have 
been raised regarding the Filament Wound Case Soild Rocket 
Boosters by the Aerospace Safety Advisory Panel for several 
years. In testimony before the Committee on May 15, 1986, Mr. 
John Brizendine, Chairman of the panel, repeated a conclusion 
from the panel’s most recent report: “Until the issue can be re- 


solved with a high level of confidence, ... the Filament 
Wound Case Solid Rocket Boosters should not be used for STS 
launch. . . .730 


Regarding the last concern in the above listing, the Committee 
notes that the recent decisions to substantially delay the availabil- 
ity of the Space Shuttle launch facilities at Vandenberg Air Force 
Base and to increase the availability of expendable launch vehicles 
could potentially eliminate the need for Filament Wound Case 
Soild Rocket Boosters. Specifically, the Filament Wound Case Solid 
Rocket Boosters were originally intended only for use at Vanden- 
berg; and the increased availability of large expendable launch ve- 
hicles may provide a viable option to heavy-lift launches using the 
Space Shuttle. 


29 Hearings before the Space Science and Applications Subcommittee of the House Science 
and Technology Committee, “Strategy for Safely Returning Space Shuttle to Flight Status," 
99th Cong., 2nd Sess., Transcript, May 15, 1986, p. 102. 


зе Тыа. 
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The current requirement for preeminent emphasis on Space 
Shuttle flight safety obviously necessitates that all major engineer- 
ing concerns such as those listed above should be identified, thor- 
oughly scrutinized, and appropriately acted upon. 


d. Desirable Tests Not Yet Approved 


Issue 1 


Із the current ground test program for the SSME adequate to 
provide a complete understanding of the engine’s operating charac- 
teristics and safety margins? 


Findings 


1. The Committee supports the Findings and Conclusions of the 
Development and Production Team concerning the SSME, particu- 
larly the concern that “Hardware availability and the potential of 
damage to hardware and facilities resulting from tests malfunc- 
tions have constrained . . . [full margin] . . . testing during the 
ground test program." 3! 

2. The Committee shares Dr. Feynman’s concern that there has 
been a slow shift toward decreasing safety in the SSME program. 

3. There is not a sufficient understanding of SSME blade cracks 
and fractures. 


Recommendations 


1. The Committee concurs with the Development and Production 
Team conclusion that over testing, limits testing, and malfunction 
testing in the SSME program should be re-emphasized to demon- 
strate full engine capability.3? 

2. NASA should prepare and submit to the Committee a cost- 
benefit analysis of testing a SSME to destruction including: (a) uti- 
lizing additional SSME test stands; (b) utilizing additional hard- 
ware for the ground test program; and (c) the value of such a test. 

3. A vigorous study of fracture behavior should be conducted to 
minimize the hazard of cracked SSME blades and to increase the 
reliability and safety margin of blades. New blades and/or new 
policies for duration of blade use should be incorporated prior to 
the next Shuttle flight. 


Discussion 


The development and operation of the SSME is a remarkable 
achievement and represents the leading edge of technology in large 
liquid hydrogen/liquid oxygen rocket engines. Great attention to 
detail was emphasized by engineers at both Rocketdyne and Mar- 
shall as well as timely recognition and resolution of technical prob- 
lems.?3 Despite intense oversight, individuals privately speculated, 
prior to the 51-L accident, that if an accident were to occur it 
would probably be the result of an SSME failure simply because of 
the uncertainties innate to a technology pushing the "edge." This 
awareness of the uncertainties promoted high quality engineering 
and contributed to the success of the SSME program unlike the ap- 


3! Rogers Commission Report, Volume II, p. K-32. 
з2 [bid. 
33 Тыа. 
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parent complacent attitude toward the mature solid rocket technol- 
ogy. 

Volume II of the Rogers Commission Report analyzes in great 
detail the development, production and operation of the SSME.34 
The Commission's Findings and Conclusions regarding the SSME 
are appropriate. However, the Committee feels that even more rig- 
orous testing of the main engine is necessary to ensure that safety 
margins and hardware reliability are not compromised. 

For example, Commission member Dr. Feynman notes that the 
“top-down” 35 approach used to design the SSME has made it diffi- 
cult and expensive to discover the causes of component and subsys- 
tem problems.?9 Specifically, Dr. Feynman writes that NASA and 
Rocketdyne (the SSME prime contractor and a division of Rockwell 
International), do not have a relatively precise knowledge of when 
a turbine blade is likely to crack, how quickly a crack will grow to 
fracture, and under what various rated power levels these phenom- 
ena will occur.37 

Mr. Jeffs, President, North American Space Operations, Rock- 
well International, described the blade problem and explained 
Rocketdyne's testing efforts to improve blade life and minimize 
blade cracks and fractures. 


... we are working the blades and bearing problems and 
have been for some time. 

We have given ourselves confidence in flying the engine 
with those kinds of blades through off-limit testing. We've 
taken the worst cracked blades we could possibly find and 
run them in engines to see if we could make those cracks 
grow. We have not been able to do so. At the same time, 
its not satisfactory for us to continue in the long-term 
flying cracked blades, and that's why we're putting so 
much effort on fixing those blades. I believe that we 
should have fixes for those blades before the next flight. 

. . . the blades on the engines . . . I hedge a little bit on 
exactly when we can incorporate those into the vehicle. I 
believe we can do it by the 1988 period, but it's going to 
take a lot of certification testing . . .38 


During staff discussions with NASA personnel, the issue of 
SSME destruction testing arose. Some NASA personnel expressed 
the desire to test an SSME to destruction, but noted the lack of test 
stands and hardware.?? Curently NASA and Rocketdyne have 
three test stands. Some individuals privately noted that the SSME 
program should have four or five test stands to run and engine to 
destruction, to test product improvements, for flight support and 
anomaly resolution, and for acceptance tests of hardware. Others 
have explained that it is not necessarily the number of test stands 
that is the key to a successful SSME program, but rather the 


34 [bid., pp. K-23 through K-27; К-31. 

35 Most military and civilian aircraft engines are designed from the bottom-up approach, in 
which each component, starting with the material used all the way through engineering testing 
of subsystems and subcomponents, is evaluated prior to the final design of the entire engine. 

36 Rogers Commission Report, Volume II, р. F-2. 

37 Ibid. 

38 Cmte Hgs, Transcript, July 15, 1986, pp. 10-12, 61. 

39 Discussion with NASA personnel, Washington, D.C., May 30, 1986. 
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amount of hardware available to feed the test stands. The Rogers 
Commission found that: 


The number of engine test firings per month had de- 
creased over the past two years. Yet this test program has 
not yet demonstrated the limits of engine operation pa- 
rameters or included tests over the full operating envelope 
to show full engine capability. In addition, tests have not 
yet been deliberately conducted to the point of failure to 
determine actual engine operating margins.*? 


In addition, Dr. Fevnman said: 


Using the completed engine as a test bed to resolve such 
questions is extremely expensive. One does not wish to lose 
entire engines in order to find out where and how failure 
occurs. Yet, and accurate knowledge of this information is 
essential to acquire a confidence in the engine reliability 
in use. Without detailed understanding, confidence can not 
be attained.*! 


There has been some concern raised about the value of testing an 
SSME to destruction. It is important that engine testing simulate 
flight as closely as possible so that information learned in testing 
can readily be applied to actual flight engines. For example, run- 
ning an engine longer than an actual flight may not be useful in 
understanding what effects starting and stopping have on lifetimes 
of engine components, such as turbine blades. However, damaging 
or destroying an engine while testing components under flight con- 
ditons will yield valuable information. Consequently, it is impor- 
tant for NASA and Rocketdyne to aggressively test components to 
their design life even at the expense of a ground failure. It is un- 
derstandable that the 51-L accident may have resulted in a more 
conservative SSME ground test program in terms of a fear of fail- 
ure. However, if safety is to be the prime consideration in the STS 
program, then there has to be the freedom to fail in order to learn. 
It is far better to lose an engine on the ground than in flight. 


Issue 2 


Is the leak/combustion threat of the External Tank's hydrogen 
pressure valve a hazard warranting testing? 


Findings 

1. The Committee supports the Rogers Commission concern re- 
garding the hazard posed by the liquid hydrogen vent and relief 
valve.*? 

2. The Committee suports the intent of the ET prime contractor, 
Martin Marietta, to pursue outdoor wind tunnel testing to elimi- 
nate the liquid hydrogen vent/relief valve hazard.*? 


*9 Rogers Commission Report, Volume I, p. 192. 
4: Ibid., Volume П, p. F-2. : 

42 Ibid., Volume І, pp. 192-93. 

аз Ibid., Volume ІІ, р. K-23. 
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Recommendation 


NASA, in conjunction with the appropriate contractor, should 
consider designing and conducting an ET liquid hydrogen leak/ 
burn test to determine if corrective actions should be taken prior to 
the next Shuttle flight. 


Discussion 


The Rogers Commission identified the hazard posed by the par- 
tially open vent/relief valve on the ET’s liquid hydrogen tank. This 
valve can indicate it is closed when, in fact, it might be partially 
open. A liquid hydrogen leak and subsequent combustion could 
result in the loss of vehicle and crew.** There are two ways of de- 
termining if the valve is closed. While both are highly accurate, 
neither can adequately assure closure. To date, 


. no test has been permitted to leak and burn hydro- 
gen in a wind tunnel and analytical methods of determin- 
ing the heating rates associated with leaking hydrogen gas 
into the 1.5-foot thick boundary layer of External Tank are 
recognized by the analyst to be inadequate and inconclu- 
sive.*5 


During the Commission investigation representatives of Martin 
Marietta stated a concern for the vent/relief valve leak hazard and 
indicated an intent to pursue outdoor wind tunnel testing.*® 


Issue 3 


Does the present Range Safety System (RSS) on the External 
Tank present an unreasonable risk? 


Finding 
There is substantial controversy over the relative benefits and 
risks of the present RSS on the External Tank. 


Recommendation 


The Committee believes the Administrator should prepare and 
submit to the Committee a comprehensive review of RSS require- 
ments. 


Discussion 


There has been considerable discussion through the years about 
the advantages and disadvantages of having a Range Safety System 
(RSS) radio controlled destruction device on the External Tank. 

There have been recorded instances of spacecraft being struck by 
lightening during the launch.*? At least some of the astronaut 
corps feel strongly that the ET RSS creates an unnecessary risk to 
the crew. 

The Committee has been informed that the ET RSS was included 
during the design phase because of a range safety requirement. 


44 Ibid., Volume I, pp. 192-93. 
45 Тыа, Volume II, p. K-23. 
46 1 


Ibid. 
41 NASA, The Apollo Spacecraft, A Chronology, 1978, Volume IV, p. 319, Appollo 12. 
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The question that should be asked is: “Ро the relative risks, and ad- 
vantages of an ET RSS justify its inclusion as a part of the STS?” 

Therefore, the Committee believes that as part of an overall 
review of safety requirements, the Administrator should ensure 
that NASA and the appropriate Air Force officials responsible for 
— б requirements review RSS requirements as they apply 
to the Я 


е. Production/Refurbishment Issues 


Issue 1 


Should 100 percent X-ray inspection of the propellant and insula- 
tion for the Solid Rocket Motors (SRM) be resumed? 
Findings 

1. Previous X-ray inspections led to only one SRM being rejected 
for Shuttle use. 

2. There is no non-destructive inspection method which can 
guarantee a defect-free SRM. X-ray inspection cannot detect “kiss- 
ing" voids in which the SRM insulation is touching the SRM steel 
casing but is not bonded to it. Debonded insulation at the end of an 
SRM segment could provide burning propellant gases with a path 
to the SRM steel casing and could result in loss of vehicle and 
crew. X-ray inspection can detect propellant cracks and large voids 
which if undetected could also result in a catastrophic situation. 

3. Although there is no guarantee that X-ray inspection has been 
a particularly effective method of detecting propellant and insula- 
tion SRM flaws, it remains one of the best available methods to 
monitor the SRM manufacturing process. 


Recommendations 


1. NASA should consider reinstating full X-ray inspection of 
the propellant and insulation for all motors used on succeeding 
flights until new, more accurate inspection methods can be devel- 
oped and implemented and there is unquestionable confidence in 
the SRM production process. | 

2. NASA, in conjunction with the appropriate contractors, 
should investigate the development of new, more accurate inspec- 
tion techniques which can detect “kissing” voids and other poten- 
tial defects that cannot be detected by X-ray inspection. 


Discussion 


While the 51-L accident has focused attention on the design of 
the SRM joint, the explosion of a Titan 34D rocket on April 18, 
1986, has focused attention on the production and inspection proc- 
esses of the SRM. Evidence has shown the Titan failure was caused 
by a “thermal insulation coating that pulled away from inside one 
of the two Solid Rocket Booster motors, allowing hot propellants to 
burn through the rocket’s outer casing” nine seconds after being 
fired from Vanderberg Air Force Base.*? 


18 Michael Isikoff, “Major Flaws Ruled Out in Two Rockets," Washington Post, July 3, 1986, p. 


106 


The Titan Solid Rocket Motors receive only visual inspection of 
bond lines and local ultrasonic inspection as required. 

While there are some significant differences between the Shuttle 
SRB and the Titan motor, the design of the Shuttle SRB was pri- 
marily based on the Air Force's Titan III solid rocket.*? Also, the 
design of the insulation on the Shuttle booster is virtually identical 
with the Titan design.5? Brig. Gen. Nathan Lindsay, Chairman of 
the Air Force board investigating the accident said, "This was a 
failure we would have assigned a very low probability to. We've 
flown 70 flights with the [Titan] Solid Rocket Motor and this was 
the first failure." 5! 

The Shuttle SRB has flown 25 flights with one unrelated failure. 
In testimony before the Rogers Commission, NASA officials “made 
it clear that the kind of separation of insulation that apparently 
led to the destruction of the Air Force Titan 34D was commonplace 
on the Shuttle." 5? According to NASA officials, it was also 
common practice to visually inspect and repair unbonded insula- 
tion of the SRM end segments.?? 

Full X-ray inspection was conducted on all SRM segments used 
in the demonstration and qualification programs and the first five 
Shuttle flights. Full X-ray inspection of these early motors was re- 
quired as part of the development and verification plan, and was 
scheduled for reassessment after the flight of STS-5. During this 
period 24 motors were fully X-rayed. Three demonstration center 
motor segments exhibited excessive voids in their propellant, but 
only one segment was rejected. Studies established the voids were 
due to low casting rate and the method of dispersing propellant 
into the segments. Аз a result controls were implemented and veri- 
fied by X-ray inspection. It was also discovered during this time 
that an SRM segment of the size required for the Shuttle could 
contain 12,000 voids and be fired successfully without threat to the 
mission, vehicle or crew. 

After evaluation of data from the SRM segments used up 
through STS-5 and data from military Solid Rocket Motors, 
NASA's confidence in the SRM production process was such that 
the SRM X-ray policy was changed. A cost-benefit analysis also 
contributed to this decision. Beginning with STS-6, X-ray inspec- 
tion was only conducted on all aft segments in the propellant hand- 
trimmed area and the segment produced following the identifica- 
tion of a process anomaly, process change, or design change. X-ray 
inspection of the aft segments in the propellant hand-trimmed area 
was continued because data indicated that only 3 percent of a seg- 
ment's insulation had to be bonded, particularly the ends, in order 
of the segment to burn properly and safely. In October of 1985 
NASA implemented a recommendation from the Aerospace Adviso- 
ry Panel to change its X-ray policy to include random inspection of 
one SRM segment per month. Because of a SRM production lead 


*9 Rogers Commission Report, Volume I, p. 121. 

59 David E. Sanger, "Кіам in Titan's Boosters is Identified," the New York Times, June 4, 
1986, p. A-23. 

5! [sikoff, pp. А-1, A-20. 

5? Sanger, p. А-28. 

53 Ibid. 
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time of approximately eight months, по SRM segment inspected 
under this new policy was flown before the 51-L accident.5* 

X-ray inspection, while the best available method to detect pro- 
pellant voids and cracks, cannot detect so-called “kissing voids” in 
which the insulation is touching but not bonded to the SRM steel 
casing. Staff discussions with NASA personnel revealed that other 
inspection methods are being analyzed. Thermography and accous- 
ticolography techniques could both be used to detect voids and un- 
bonded insulation. These techniques may not be refined enough to 
use on the boosters flown on the next Shuttle flight. However, a 
mechanical pull test should be available to test the new motors to 
ensure that insulation is bonded to the SRM steel casings prior to 
pouring the propellant. In addition, NASA will reinstate its initial 
100 percent full X-ray policy which applied to the earlier demon- 
stration motors and first five flights. According to NASA officials 
the continued use of X-ray inspection once Shuttle flights have re- 
sumed will depend upon success of the new SRM design and devel- 
opment of new inspection techniques. 


Issue 2 


Are all production and other activities involving Criticality 1 and 
1R hardware at prime and secondary contractor facilities labeled 
as "critical" processes? 

Findings 

1. Critical processes are formally identified and controlled by 
NASA. All processes are classified and controlled by the contrac- 
tor's Process Change Control Board.55 

2. The O-ring used in the case joint is critical to the sealing in- 
tegrity of the joint, yet it is not designated as a "critical process by 
either the Parker деді Со. ог Hydrapack, the manufacturer and 
supplier respectively.59 This raises the possibility that other Criti- 
cality 1 and 1R hardware components are also not appropriately 

designated by their manufacturer as “critical” processes. 


Recommendations 


1. NASA should require the manufacture of critical items, such 
as the O-rings, to be designated "critical" processes. Contractors 
should formally notify their employees involved in critical manu- 
facturing processes of the serious nature of particular production 
processes. 

2. NASA should conduct a thorough review to ensure that all 
manufacturing processes involving Criticality 1 and 1R hardware 
components of prime and secondary contractors are appropriately 
designated "critical" processes. 


Discussion 


"Critical processes are formally identified and controlled by 
NASA. АП processes are classified and controlled by the contrac- 
tor's Process Change Control Board." 57 Failure of Criticality 1 and 


54 Discussion with NASA personnel, Washington, D.C., Sept. 12, 1986. 
55 Rogers Commission Report, Volume II, p. K-14. 

56 Thid., p. K-31. 

57 Ibid., р. K-14. 
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1R components ог systems will result іп loss of vehicle and/or 
crew. The Commission’s investigation revealed that the O-ring used 
in the case joint, whose failure led to the destruction of 51-L, was 
not designated a critical ргосеѕѕ.58 NASA personnel explained that 
O-ring production was not so classified because final O-ring inspec- 
tion occurred at К5С.59 

NASA’s safety, reliability and quality assurance (SR&QA) philos- 
ophy is that you cannot inspect quality into products, rather you 
must build it in. It is questionable, then, why NASA would choose 
to rely solely upon O-ring inspection for quality control and not 
emphasize the criticality of the O-ring production process to the O- 
ring manufacturers and their employees. 

While the O-ring manufacturing process did not contribute to the 
51-L accident, the fact that such a critical item was not designated 
a critical process raises the possibility that other critical items may 
not be so designated. Identifying critical processes and educating 
contractors and subcontractors about critical items and manufac- 
turing processes would be in line with NASA’s policy of building in 
quality and safety. 


Issue 3 

Do O-ring repairs compromise safety? 
Finding 

The Committee supports the Development and Production Team 
Finding and conclusion that the “limit of five repair joints 
per O-ring is an arbitrary number” and that “repair of inclusions 


and voids іп the rubber . . . appears to be an area of potential 
problem." 60 


Recommendation 


NASA should review its O-ring repair policy and contractor 
repair practices in terms of their effects on O-ring performance and 
safety. Such review should be completed prior to the resumption of 
Shuttle flights if, as anticipated, the new SRB joint design 
uses O-rings. 


Discussion 


The NASA/Commission Development and Production Team 
questioned the adequacy of the SRM joint O-ring process and qual- 
ity control. According to the D&P Team, "the O-ring is allowed to 
include five scarf joints, a quantity which is arbitrarily established, 
and repairs of inclusions and voids are routinely made by the 
vendor after receipt of the material supplies"'.5! 


Issue 4 


What impact does growth of SRM case size have upon booster 
and Shuttle performance and safety? 


58 Thid., p. K-31. 

59 Staff meeting with NASA personnel, Headquarters, Washington, D.C., May 13, 1986. 
60 Rogers Commission Report, Volume II, p. K-31. 

$1 Thid., р. K-3. 
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Finding | 

The Committee concurs with the Development and Production 
Team Finding that “Remeasurement of two used SRM case seg- 
ments indicated both tang and clevis sealing surfaces have in- 
creased in diameter beyond the anticipated design limits.” 62 


Recommendation 


NASA and the appropriate contractor should resolve through 
analysis and testing prior to the next Shuttle flight the cause of 
SRM case size growth and its impact upon booster and Shuttle per- 
formance, reliability of refurbished SRM case segments, and safety. 


Discussion 


During the investigation of the 51-L accident, the NASA/Com- 
mission D&P Team “determined by measurement of two flown case 
segments that both the SRM tang and clevis sealing surfaces have 
increased in diameter beyond the anticipated design limits. The 
growth is believed to be material related and related to the hydro- 
static proof test pressure level." 63 


f. Review of NASA’s Redesign/Recertification Plan 


Issue 


Is NASA's SRM redesign and hardware recertification plan a 
viable and realistic one which will result in a safer, more reliable 
Space Transportation System? 


Findings 


1. NASA’s SRM redesign plan is a step in the right direction. 
Moving the proposed launch date beyond June 1987 is a responsible 
and realistic decision. The membership of the SRM Redesign Team 
is representative of qualified individuals in and outside of NASA. 
With the expert assistance of the specially appointed National Re- 
search Council (NRC) Independent Oversight Group, the new SRM 
design should be a significantly safer and more reliable Shuttle ele- 
ment. 

2. NASA’s current hardware recertification plan is also a step in 
the right direction. The use of independent review contractors dis- 
tinguishes this recertification plan from earlier reviews. However, 
given the failure of previous reviews to discover the deficient SRB 
joint certification, the Committee is concerned there is still the pos- 
sibility that the recertification effort may not reveal other certifica- 
tion deficiencies, if indeed they exist. The plan also raises concern 
about the qualifications of independent reviewers to evaluate cer- 
tain elements given the uniqueness of particular Shuttle compo- 
nents. 

3. The joint was never fully tested as a separate element of the 
SRM. The various forces that act on the joint during stacking, 
launch, and flight are difficult, if not impossible, to duplicate in a 
test of the joint under all conditions that could be experienced 
during launch and flight. 


ва Thid., р. K-31. 
ез Тыа. p. K-3. 
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4. It is unclear what function the new Safety Office will perform 
in the redesign of the SRB field joint and other critical elements of 
the Shuttle, as well as NASA’s recertification plan. 


Recommendations 


1. The Committee recognizes the national need to return the 
Shuttle to flight status as soon as reasonably possible. As noted in 
NASA’s July 14, 1986, report to the President, safety will deter- 
mine the launch schedule. However, NASA should consider the 
proposed launch date of early 1988 as a flexible one which should 
be slipped further if necessary. The Shuttle should not be launched 
again until NASA can assure that safety criteria have been met. 

2. In establishing a test program to certify the new Solid Rocket 
Motor design, NASA should consider the feasibility of including in 
combination and in the proper sequence all of the thermal and 
structural loads expected to be experienced by the Solid Rocket 
Motor during ignition, lift-off, and flight. 

3. The independent review contractors participating in the hard- 
ware recertification plan should utilize sufficient specific technical 
expertise to insure adequate recertification of all elements of the 


4. The Committee requests that the new Office of Safety, Reli- 
ability and Quality Assurance conduct an independent assessment 
of the SRB field joint redesign efforts. In addition, the new office 
should also be integrally involved in reviewing all other critical 
component redesign efforts and NASA’s recertification plan. 


Discussion 


The "Strategy for Safely Returning the Space Shuttle to Flight 
Status” includes the plans to redesign the SRM joint, reverify 
hardware design requirements, and to completely review all “criti- 
cal” items. This strategy was proposed March 24, 1986, by Admiral 
Truly, the Associate Administrator for Space Flight and supple- 
ments the Rogers Commission's recommendations. ®* 

The redesign of the SRM joint is being conducted and supervised 
by a cross section of competent and qualified individuals from 
NASA centers, including Marshall Space Flight Center, the Astro- 
naut Office, and individuals from outside NASA. An expert adviso- 
ry panel of 12 people, six from outside NASA, has also been ap- 
pointed. Further, at the request of the NASA Administrator, the 
National Research Council has established an Independent Over- 
sight Group which reports directly to the Administrator. (See Ap- 
pendix VI-B.) 

To date, *many design alternatives have been evaluated, analy- 
ses and tests have been conducted, initial verification plans have 
been established, and overall schedules have been developed."95 In 
addition to designing a new joint that will use existing hardware, 
an alternate design that does not use current hardware is also un- 
derway. Study contracts have been let to five companies to inde- 
pendently develop new designs and review current baseline ideas 
and tests already conducted by NASA. 


94 NASA Response to Rogers Commission, July 14, 1986, pp. 37-40. 
65 Ibid., p. 12. 
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In 1985, as joint problems continued with the Solid Rocket 
Motors, NASA recognized the need for a design that would limit 
the rotational movement between the joint tang and clevis that 
occurs at motor ignition. NASA was embarking on the design of a 
Filament Wound Casing which would have the advantage of allow- 
ing for an increase in payload. Since a new design was called for, it 
was to NASA’s advantage to correct some of the joint problems at 
this time. In the new design, to reduce the rotational movement in 
the joint, a hook was added to the inner leg of the clevis. This 
would significantly limit any change in the spacing gap between 
the tang and the clevis in the area where the O-rings are installed. 
Shortly thereafter, Thiokol, on its own initiative, ordered new forg- 
ings which were thicker in the tang area so that the capture fea- 
ture could be machined into the casing. The hook has become know 
as the “capture feature’. In August of 1985, however, the capture 
feature then under consideration was significantly different than 
current joint designs with the capture feature. Some of these differ- 
ences include the presence of a third O-ring, the addition of a 
second pressure test port, the adoption of an interlocking design for 
the case insulation in the vicinity of the joint, and the removal of 
all putty from the joint. 

The new design, however, with the capture feature, appears to 
complicate the stacking operations and could increase the potential 
for damage, particularly leading to the creating of metal silvers 
during mating operations. 

The hardware recertification plan appears to be a thorough ap- 
proach to verifying that components meet design requirements. 
The recertification plan involves three levels of review to be con- 
ducted by: (1) NASA personnel; (2) current Shuttle contractors; and 
(8) independent contractors. 

A major concern about the thoroughness of the hardware recerti- 
fication plan was expressed by Mr. Nelson: 


. . . looking back оп how the whole system functioned we 
found out that there were a whole bunch of people in- 
volved in the SRB design and the certification process. 
There were the internal groups at Thiokol; there was the 
oversight by Marshall; there was a through review by an 
outside group, headed by Dr. Williams; there was the 
Aerospace Safety Advisory Panel; there was the certifica- 
tion process and signing off, [not only for the test flights] 
but for the first Shuttle flight, STS-1; and then there was 
that same certification process and signing off again that 
occurred before STS-5. 
Now, still all of those problems went undetected by so 
many groups.99 
A more detailed discussion of previous hardware certification is 
in Section VI-A.1.a. of this report. 
Mr. Nelson further asked how this plan could provide confidence 
that it is relatively safe to fly again. 


$6 Cmte Hgs, Transcript, July 15, 1986, p. 95. 
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The use of independent contractors distinguishes this recertifica- 
tion plan from previous ones. Mr. Davis, President, Martin Mariet- 
ta Michoud Aerospace, said: 


. . . some of the things that are being done differently . . . 
I think will help . . . Marshall Space Flight Center has 
contracted with other companies for independent FMEA/ 
CIL assessments of their hardware. In particular, Rockwell 
is doing a total independent assessment of my External 
Tank hardware, and I think that's wel! looked-to. I look to 
their expertise to question everything we did and maybe 
give us some advicé on how to make it better.” 


Mr. Murphy, Executive Vice President and General Manager, 
United Technology Booster Production Company, commented: 


I think one of the things that is going to prevent a re- 
currence of what happened in the past, as far as oversight 
committees are concerned, is that we have come a long 
ways since the initial certification of the program. We now 
have advanced analytical tools which were not available 
before. We also have the flight environments for the 24 su- 
cessful flights; it gives us a true indication of what the en- 
vironment is that we're going to be facing. Plus, again, the 
environment of the whole aerospace industry has changed 
dramatically since 51-L. And all of these, I think, will be 
taken into consideration and will provide the oversight 
and the proper review of items that never occurred 
реѓоге.68 


Mr. Murphy explained how his company will recertify the new 
SRB design: 


The recertification has three primary elements which 
follow a logical progression of evaluation. First, we will re- 
establish the basic design requirements from Level II and 
Level III. Second, we will establish a verification program 
based upon those requirements. And third, we will reestab- 
lish that the design and the hardware are in compliance 
with the first two elements. 

Key activities to be performed as we recertify the SRB 
will include the traceability of all the requirements into 
all levels of SRB design and system environments, verifica- 
tion of the SRB design data base and analyses, establish- 
ment of tools such as the failure modes and effects analy- 
sis, and validation that our paper systems have properly 
incorporated requirements, constraints, and criteria.9? 


Another distinction of this plan is that hardware will be com- 
pletely recertified through actual testing and analysis as if it were 
being done for the first time. Some earlier certification reviews 
were abbreviated paper checks many of which focused on only cer- 
tain components. 


87 [bid., р. 96. 
ва Tbid., p. 98. 
вэ Tbid., p. 50. 
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Mr. Кок... . we're talking, where at all possible, actual 
field testing. Do you concur with that approach? . . . 

Mr. Davis. Yes, Га say I agree with that. As a matter of 
fact, I believe that’s what all the program contractors, are 
out doing at this point.7° 


The use of independent review contractors is a necessary and 
critical component of the recertification plan. However, a legiti- 
mate concern has been raised by the current contractors and Com- 
mittee staff regarding the ability of independent contractors to 
review technologies and components for which they may have lim- 
ited expertise. For example, solid and liquid rocket propulsion has 
often been referred to as a “black art” for which there are few ex- 
perts. NASA has contracted with Martin Marietta to independent- 
ly review the SRB and SRM certification. Understanding the 
uniqueness of rocket propulsion, Martin Marietta has supplement- 
ed their in-house talent with outside experts to assist in the certifi- 
cation review. 

The complete review of the Critical Items List (CIL), Hazard 
Analyses (HA), and Failure Modes and Effects Analyses (FMEA) is 
in response to the Rogers Commission’s third recommendation and 
is intended to identify those items that must be improved prior to 
flight, and to affirm the completeness and accuracy of each FMEA/ 
CIL for the current NSTS design. This is the first such review since 
the system was originally instituted at the beginning of the NSTS 
program and involves, according to NASA, many man-hours of 
effort and a very large staff. Supporting this effort are independent 
contractor reviews of the various FMEA/CIL activities associated 
with each major component and system of the National Space 
Transportation System. There are six such activities. These in- 
clude, in addition to the four major subsystems that comprise the 
Shuttle (Orbiter, Solid Rocket Booster, Space Shuttle Main Engine, 
and the External Tank), the Vandenberg Launch Site and the Ken- 
nedy Space Center operations. The re-evaluation is scheduled to be 
completed by March 1987. It will involve all levels of NASA man- 
agement, with auditing and oversight functions to be provided by 
outside personnel from the Aerospace Safety Advisory Panel and 
the National Research Council in accordance with the recommen- 
dations of the Rogers Commission. 

A reconsideration of the level of design center involvement (i.e., 
the field centers that are responsible for designing various compo- 
nents of the Shuttle) in equipment processing or systems processing 
is required. The establishment of an Office of Safety, Reliability 
and Quality Assurance under a separate Associate Administrator 
should lead to improvements or an increase in the audit activities 
associated with the overall development and production process ac- 
tivities within the program. A systems design review that is pres- 
ently underway within NASA has led to some 70 or 80 items over 
and above the CIL review that have been brought to the attention 
of Level II as potential problem агеав.?! 


то Ibid., pp. 59-60. 
71 Discussion with NASA officials, Washington, D.C., July 10, 1986. 
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Program management at Level II has requested а complete audit 
of the problem reporting system in order to assure that only priori- 
ty issues are elevated to the Level II status for review. NASA sug- 
gests the problem has been that too many items of lower categori- 
zation than Criticality 1 or 1R have been brought up to Level II 
and have swamped the ability of this management level to ade- 
quately analyze Criticality 1 items. 

The new office of Safety Reliability and Quality Assurance is 
now operational. It is the view of the new Associate Administrator 
that the role of the SR&QA office will be to assure that modifica- 
tions to the SRB field joint design, are extensively reviewed during 
the processes of development, fabrication and testing."? It is the 
plan of this office to establish a position at headquarters to review 
the configuration management system that presently operates 
across the National Space Transportation System. It is also a goal 
of the Associate Administrator to establish and improve lines of 
communication among the various NSTS elements in order to im- 
prove component integration and information interfacing among 
the various elements of the Shuttle. 

The Committee is fully aware that faulty designs, improper fabri- 
cation techniques and component certification efforts can only be 
detected and identified through the implementation of proper qual- 
ity control methods and procedures. The task of the NSTS program 
managers and the contractors is to assure that the quality is built 
into the design and production of Shuttle hardward. Nevertheless, 
the Committee also recognizes that the highest level of quality con- 
trol methods and reliability engineering must be applied to all 
phases of the Shuttle production process, utilizing the latest state- 
of-the-art techniques of testing and analyses. 


2. OPERATIONS 
a. Shuttle Processing Issues (including Spare Parts) 


Issue 


In 1983, NASA consolidated fifteen separate contracts and 
awarded a single Shuttle Processing Contract (SPC) encompassing 
all ground processing related to launch and landing of the Space 
Shuttle. There are two issues associated with this contract: (1) How 
sound is the concept of a unified SPC; and (2) How well has the 
SPC contractor actually performed? A related issue is the quality 
of essential logistical support, especially spare parts, provided to 
the contractor by NASA. 


Findings 

1. Performance under the SPC has improved since the inception 
of the contract. However, up to the time of the Challenger accident, 
contractor performance continued to be plagued by excessive over- 
time, persistent failures to follow prescribed work procedures, and 
inadequate logistical support from NASA. 

2. High overtime rates have hampered SPC performance. Over- 
time rates had increased significantly during the six months prior 


12 Discussion with NASA officials, Washington, D.C., August 18, 1986. 
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to the Challenger launch, to the point that critical personnel were 
working weeks of consecutive workdays and multiple strings of 11- 
and 12-hour days. Fatigue resulting from work patterns of this sort 
can constitute a threat to safety. In fact, worker fatigue was a con- 
tributing factor in a mission-threatening incident on Flight 61-C, 
the mission immediately prior to the January 28 Challenger 
launch. 

3. There are numerous documented cases when contractor em- 
ployees failed to comply with guidelines for carrying out assigned 
duties, including specific ‘Operations and Maintenance Instruc- 
tions" (OMI’s). Such failures contributed to both of the major mis- 
haps in 1985 involving Shuttle processing—namely, the November 
8, 1985, "handling ring" episode which led to significant damage to 
a Solid Rocket Motor segment slated for use on STS51-L, and the 
March 8, 1985, “payload bay access platform” episode which led to 
significant damage to a payload bay door. Failure to follow an OMI 
also led to improper (and mission-threatening) handling of the hy- 
drogen disconnect valve during the 51-L launch operations. All of 
these incidents show a lack of discipline, both with respect to fol- 
lowing prescribed procedures and with respect to reporting viola- 
tions of these procedures. 

4. At the time of the Challenger accident, the lack of spare parts 
caused a degree of cannibalization (1.6., the removal of a part from 
one Orbiter to satisfy a need for a spare part on another Orbiter), 
which was the highest in the history of the Shuttle program and 
which was a threat to flight schedule and flight safety. Excessive 
cannibalization leads to multiple installations, retesting, added doc- 
umentation, delayed access to parts, and increased damage poten- 
tial. As a result, cannibalization contributes directly to excessive 
overtime. 

5. There is no clear evidence whether or not greater involvement 
of the development contractors would improve Shuttle operations. 


Recommendations 


1. Because of the serious quality and safety concerns surround- 
ing the contract, NASA should conduct a careful review of Shuttle 
processing, the SPC contract, and the relationship of flight hard- 
ware contractors and report its findings, recommendations, and 
proposed contract modifications to the Committee. NASA’s reexam- 
ination should include a comparison of efficiency and safety under 
the SPC versus efficiency and safety during pre-1983 Shuttle proc- 
essing operations, which heavily involved the development contrac- 
tors. 

2. NASA should examine the issues of spares availability and 
cannibalization and provide the Congress with a management and 
budgetary plan for correcting previous logistical problems. 

3. NASA should stop routine cannibalization and develop guide- 
lines (including appropriate control and review procedures and 
roles for the SR&QA office) governing permissible cannibalization. 

4. The Committee recommends that NASA provide its re-invig- 
orated safety office with the authority to enforce scheduling that 
leads to safe overtime rates. 
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Discussion 


In a press release dated September 5, 1986, NASA announced 
that it has extended the SPC with Lockheed for three additional 
years, beginning October 1, 1986. Admiral Truly also announced 
his intent to conduct a thorough review of the SPC, a process 
which might lead to contract amendments. 

Lockheed’s award fees at the Kennedy Space Center have not 
been at the highest possible levels due to mishaps and management 
problems. The contractor has received the following award fees for 
Shuttle processing at KSC: 


LOCKHEED SHUTTLE PROCESSING CONTRACT—AWARD FEE HISTORY 


р Percent of 
Period From — Rating adjective Rating маг гай “ЫГ 
earned 
Шыны атола Oct. 1, 1983............ $6,618,880 Excellent ............... 90.0 80 55295104 
$есопд........................................... Apr. 1, 1984 ............ 1,299,404 000d ..................... 78.5 32 415,809 
Thild р ratte Oct. 1, 1984 ............ 1,308,554 600@..................... 76.0 24 314,053 
БОЙ... Арг. 1, 1985........ 1,308,554 Excellent ............... 91.0 84 1,099,185 
ШИ ам E Oct. 1, 1985 ............ 1,308,554 Very good ............. 89.0 76 994,50} 
SIX Ss ана Арг. 1, 1986......... 1,296,664 (1)....................... (1) (1) (1) 
1 То бе determined. 


The rating scale runs from unacceptable to marginal, good, very 
good, excellent and superior. Two of the five ratings to date have 
been at the lower end of the scale. 

At the time of the Challenger accident, Shuttle processing had 
suffered from inadequate spare parts for well over a year, and the 
problem was getting worse. The inventory of spare parts had run 
close to projections until the second quarter of fiscal year 1985. At 
that time, inventory requirements for spares began to increase 
faster than deliveries. A year later, the inventory should have been 
complete, but only 65 percent had been delivered."? 

The number of cannibalized parts was increasing at an alarming 
rate. Forty-five out of almost 300 required parts were cannibalized 
for Challenger before Mission 51-L.74 Eighty-five parts were canni- 
balized on 61-C, the mission preceding 51-L.7° In fact, the number 
of cannibalized parts on each of these 1986 missions far exceeded 
the number of cannibalized parts on any previous mission. In 14 
missions flown in 1984-1985, the average number of cannibalized 
parts was 14; in the 1986 mission, the number had increased nearly 
five-fold to 65. 

The cause of the spare parts crisis was budgetary decisionmaking 
by NASA management. In October, 1985, the logistics funding re- 
quirements for the Orbiter program, as determined by Level IIT 
management at Johnson, were $285.3 million, but that funding was 
reduced by $83.3 million, necessitating major deferral of purchases 
of spares./$ By the spring of 1986, the Shuttle logistics program 


Ён — Commission Report, Volume II, р. 1-16. 
id. 

15 Cmte Нив, Transcript, July 16, 1986, р. 42. 

76 Rogers Commission Report, Volume I, р. 178. 
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was about one year behind; and under the proposed flight schedule, 
no Orbiters would have been available as spare parts bins. 

NASA is well aware of the spare parts problem. In fact, during 
the Committee’s hearings, Admiral Truly testified: 


I can assure you that during our downtime we're going 
to take a hard look at it and make sure that the flight 
rates that we build up to after this accident are support- 
able by the logistics system that we have in рїасе.7? 


The Committee received mixed reactions on whether develop- 
ment contractors need to be more involved in the SPC. Proponents 
of this approach argue that the current separation of responsibil- 
ities between the design organizations and the processing organiza- 
tion has created additional interfaces which make coordination, 
communication, and responsiveness more complex. Further, the 
processing contractor may not possess the necessary technical back- 
ground to recognize either system degradation resulting from mul- 
tiple missions or the criticality of the hardware being tested and 
processed."? The Rogers Commission report stated that the likeli- 
hood of improper Shuttle processing would probably be decreased if 
Rockwell, as overall development contractor, and Martin Marietta, 
who has a consulting role on the pre-launch processing of the Ex- 
ternal Tank, were subcontractors to Lockheed, as the other Shuttle 
development contractors аге.79 

At Committee hearings, contractors reacted predictably to pro- 
posed changes in the SPC. Development contractors, such as Rock- 
well and Martin Marietta, told the Committee that their organiza- 
tions should be vested with beginning-to-end responsibility—design, 
development, manufacturing, operation, and refurbishment of their 
respective Shuttle element.$? Lockheed, on the other hand, argued 
that there is already a very close relationship between itself and 
the development contractors. For example, there is one develop- 
ment engineer for every four Lockheed engineers. Development 
contractors participate in all meetings and are required to author- 
ize and approve anything that is anomalous to the regular docu- 
mented procedure.?! 

Ultimately, SPC performance will determine the proper balance 
of development contractors in the processing contract. NASA, in 
close consultation with the Congress, will need to make an impar- 
tial and ongoing assessment of comparative safety and performance 
under a consolidated versus unconsolidated SPC. Preliminary fig- 
ures from NASA seem to indicate that Shuttle processing incidents 
have actually declined during the more recent consolidated-con- 
tract phase.®? Further, it is likely that the fundamental problem to 
date with the SPC—overtime—would be exacerbated by the addi- 
tional contractor coordination that would be required by greater in- 
clusion of development contractors. 


77 Cmte Hgs, Transcript, July 11, 1986, p. 39. 

18 Rogers Commission Report, Volume II, p. K-32. 

19 Rogers Commission Report, Volume I, р. 195. 

89 Cmte Hgs, Transcript, July 15, 1986, p. 62. 

81 Cmte Hgs, Transcript, July 16, 1986, pp. 13-14. 

$2 NASA, documents on the SPC contract, supplied to the Committee in July, 1986; Cmte Hgs, 
Transcript, July 16, 1986, p. 67, and Attachment C. 
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The responsibility for high overtime rates in the SPC must ђе 
shared by both NASA and the contractor. Mr. E.D. Sargent, Presi- 
dent of Lockheed Space Operations Company, testified: 


One of the problems that bothers us and drives us to 
overtime is either unplanned work or another form of un- 
planned work which is a hold or abort on the pad where 
we have critical skills that are required to perform func- 
tions. 


There is no doubt that late mission changes initiated by NASA 
are in large part responsible for Lockheed exceeding the five per- 
cent overtime target in the SPC contract. 

But in fact overtime levels had grown from an initial SPC rate of 
5.3 percent in April, 1984, to 13.9 percent in January, 1986—levels 
far in excess of what could be attributed solely to late mission 
changes. The peak monthly overtime level of 15.2 percent occurred 
in November, 1985. Although NASA managers at Kennedy at- 
tribute the November rate to the Thanksgiving holiday, the overall 
trend in overtime is undeniable—for each of the six months prior 
to the launch of STS 51-L, overtime exceeded 10 percent.84 

More important that the average overtime rates was the over- 
time for certain employees with critical skills. Records show that 
there was a frequent pattern at Kennedy of combining weeks of 
consecutive workdays with multiple strings of 11- or 12-hour days. 
For example, one Lockheed mechanical technician team leader 
worked 60, 96.5, 94, and 80.8 hours per week in succession during 
the four weeks ending January 81, 1986.35 While shiftwork is com- 
monplace in many industrial settings, few can equal a Shuttle 
launch’s potential for inducing pressure to work beyond reasonable 
overtime limits. 

Research has shown that when overtime becomes excessive, 
worker efficiency decreases and the potential for human error 
rises. Noteworthy in this regard is Lockheed’s review of 264 inci- 
dents that caused property damage in 1984 and 1985. More than 50 
percent of these incidents were attributable to human error, in- 
cluding procedural deviations, miscommunications and safety 
violations. On one occasion a potentially catastrophic error oc- 
curred just minutes before a scrubbed launch of Shuttle flight 61-C 
on January 6, 1986, when 18,000 pounds of liquid oxygen were in- 
advertently drained from the Shuttle's External Tank. The investi- 
gation which followed cited operator fatigue as one of the major 
factors contributing to this incident. The operators had been on 
duty at the console for eleven hours during the third day of work- 
ing 12-hour night shifts. If the launch had not been held 31 seconds 
before lift off, the mission might not have achieved orbit.9" 

The adequacy of and adherence to Operations and Maintenance 
Instructions (OMI'3) have been raised as areas of concern leading to 
quality and safety problems. Review of various SPC mishap reports 
and of the procedures leading to the launch of 51-L and earlier 


33 Cmte Hgs, Transcript, July 16, 1986, p. 24. 

84 NASA, documents on the SPC contract, supplied to the Committee in July, 1986. 
85 Rogers Commission Report, Volume ЇЇ, pp. G-2-3. 

86 Ibid., р. G-1. 
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Shuttle flights highlight both the need for review and update of іп- 
adequate OMI’s and the need for improved contractor performance 
in implementing adequate OMI’s.*® NASA's own review of flight 
51-L showed several examples of improperly implemented ргосе- 
dures. The most serious error occurred when a console operator im- 
properly closed the liquid hydrogen disconnect valve to the Exter- 
nal Tank liquid hydrogen manifold. Although the valve appeared 
to function during 51-L, improper valve operation could have 
doomed 51-L just as surely as the failed rocket booster. As impor- 
tant as the failure to follow the OMI was the fact that the valve 
closure problem was never documented. Without proper documen- 
tation a full assessment of the problem was not made prior to 
launch of 51-L. This lack of documentation is reminiscent of 
what occurred during “de-stacking” of Solid Rocket Motor seg- 
ments from STS-9. Although destacking revealed water in the 
joints, this incident was never documented—an oversight which ul- 
timately may have prevented an appreciation of the dangers of ice 
formation in booster joints during a cold-weather launch.?^ 


b. Pressures on Shuttle Operations 


Issue 


Was NASA under pressure to fly more flights? How did this 
pressure originate? Will it recur? 
Findings 

l. The Congress and the Executive Branch jointly developed the 
policy that the Space Shuttle should, in a reliable fashion and at 
an internationally competitive cost, provide for most of the Free 
World's space launch needs. By and large, both Branches failed to 
appreciate the impact that this policy was having on the operation- . 
al safety of the system. 

2. NASA was under internal and external pressure to build its 
Shuttle flight rate to 24 per year, primarily to reduce costs per 
flight, but also to demonstrate and achieve routine access to space. 
NASA has never achieved its planned flight rate. 


Recommendations 


1. NASA must not attempt to achieve a flight rate beyond that 
which (i) can be supported by the budget and staff resources avail- 
able; and (ii) is consistent with the technical maturity of the Shut- 
tle and the flexibility desired and needed in scheduling payloads. 
Management should ensure efficient use of resources but should 
not impose a flight rate on the system. 

2. Once operation of the Space Shuttle resumes, the Committee 
should maintain a close and continuous oversight of Shuttle flight 
rate, planning, and operations. The Committee should ensure both 
that flight rate flows logically from the resources provided and that 
flight safety is not compromised beyond acceptable limits. 


88 Kennedy Space Center Mishap Reports, No. 85-0070, April 5, 1985, and No. 86-0024, Dec. 
18, 1985. 

39 Rogers Commission Report, Volume II, p. 1-15. 

90 Tbid. p. 1-14. 
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Discussion 


Flight Rate. The goal of the Shuttle program has been to become 
the Nation’s primary space transportation system launching virtu- 
ally all U.S. payloads and many foreign payloads, all at a reasona- 
ble price. Thus, there has been an explicit promise to deliver 
launch services. 

Being a very complicated vehicle, the Shuttle demands a large 
trained workforce which must be retained between launches. In ad- 
dition, there are the costs of maintaining large and complex launch 
facilities. Therefore, there is a large fixed cost in the Shuttle pro- 
gram of approximately $1.2 billion per year. By comparison the ad- 
ditive or marginal cost for a single flight is around $60 million (de- 
pending on how the accounting is done). Therefore, it is clear that 
(within limits) the cost-per-flight can be reduced by flying more 
flights, that is, by spreading the large fixed cost over more flights. 
However, it is also clear that the total cost—that is, the total 
amount of money that has to be appropriated—will increase as the 
number of flights increases because fixed costs are fixed and mar- 
ginal costs must be added for each additional flight. 

Therefore, to focus on cost-per-flight can be misleading. A lower 
cost-per-flight, achieved by flying more often, would allow a lower 
price to be charged to users, but does not lower the cost of the pro- 
gram. Because NASA had committed to lower the price to custom- 
ers of Shuttle flights, there was a pressure to do this by increasing 
the flight rate. Nevertheless, NASA never achieved its planned 
flight rate. 

For example, in 1976 NASA predicted 49 flights in fiscal 1984 
and 58 in 1985. As late as August 15, 1988, 45 days before the start 
of fiscal year 1984, NASA planned 9 flights for fiscal 1984 and 12 
for 1985. NASA actually flew four Shuttle flights in fiscal 1984 and 
8 in 1985.91 Of course management worked hard to reduce this gap 
between plans and performance. 

The emphasis on reducing costs per flight and delivering launch 
services has caused a very basic and pervasive pressure to increase 
the flight rate in the Shuttle program. This is well documented in 
Chapter VIII of the Rogers Commission герогї.9? 

Presumably, the Challenger accident has changed this situation. 
Recommendation VIII of the Rogers Commission states in part that 
"NASA must establish a flight rate that is consistent with its 
resources."?3 NASA's response to this recommendation hints that 
this may not be the case. NASA speaks of determining “the maxi- 
mum achievable safe flight rate."?* Such a flight rate would again 
leave no “margin in the system to accommodate unforeseen hard- 
ware problems" as the Commission found was the case before the 
accident.?5 The NASA response makes it clear that the flight rate 


91 Hearings before the House Committee on Science and Technology, КУ 1978 NASA Authori- 
zation, September 14, 1976, Volume I, Part 1, p. 394; NASA, "Space Shuttle Payload Flight As- 
— August 15, 1983. NASA; “Space Shuttle Payload Flight Assignments," November, 

85. 

92 Rogers Commission Report, Volume I, pp. 164-77. 

93 Tbid., p. 201. 

94 NASA Response to Rogers Commission, Juy 14, 1986, pp. 30-31. 

25 Rogers Commission Report, Volume 1, p. 177. 
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will be determine based оп studies and that “program епћапсе- 
ments .. . required to achieve the flight rate" will be implemented 
[emphasis added].99 This is reinforced in the NASA response to 
Recommendation IX where NASA says “NASA has initiated an as- 
sessment of spare parts requirements to adequately support the 
flight rate planning." [emphasis added] 97 Thus, it seems that once 
again a planned flight rate could become a controlling factor. 

A finding of the Pre-Launch Activities Team is that during the 
preparation of 51-L for launch “Manpower limitations due to high 
workload created scheduling difficulties and contributed to oper- 
ational problems." 98 This is perhaps one of the clearest examples 
of the inappropriate logic at work in the system before the acci- 
dent, because "manpower limitations" are not due to "high work- 
load" in the system. Manpower and other resources are limited 
before the workload is planned. Problems are created when the 
workload assigned is inappropriate to the manpower available. 

In a March 24, 1986, memorandum on “Strategy for Safely Re- 
turning the Space Shuttle to Flight Status," Admiral Truly reveals 
a better attitude toward flight rate in speaking of a "realistic and 

. . achievable launch rate that will be safely sustainable." Admi- 
ral Truly also states that "the ultimate safe sustainable flight rate 
and the build up to that rate will be developed utilizing a 'bottoms 
up’ approach in which all required work for the standard Ном... 
is identified and that work is optimized in relation to the available 
work force.’’99 

NASA prepared several reports for the Rogers Commission, and 
the Mission Planning and Operations Team (MPOT) Report indi- 
cates a good awareness of the general problem of over-ambitious 
flight rate planning. For example, that report states that compared 
to the need to devote resources to making the transition to an oper- 
ational system the "increasing flight rate had the highest priority." 
The MPOT report continues, “In other words, it appears that the 
flight rate was not tied to the ability of the system to support it, 
but rather the system was reacting to the established flight rate." 
A major conclusion of the MPOT report is that “The NSTS Рго- 
gram should develop a bottoms-up strategy for expanding flight 
rate."199 In other words, flight rate cannot be imposed from above, 
but must be determined by available resources. 

The disturbing fact is the trend in the NASA statements. The 
earlier statements (i.e., the Truly memo and the MPOT report) in- 
dicated an awareness of the danger of trying to achieve an imposed 
flight rate. However, as mentioned above, the most recent state- 
ment, the NASA response to the Commission, once again speaks of 
achieving the planned flight rate. 

The Rogers Commission has documented the fact that before the 
Challenger accident the Shuttle system was approaching a state of 
saturation in which no more flights could be accommodated. If the 
accident had not occurred flight rate saturation may have eventu- 
ally been reached due to bottlenecks in crew training on the mis- 


26 NASA Response to Rogers Commission, July 14, 1986, p. 31. 
97 [bid., p. 33. 

28 Rogers Commission Report, Volume II, p. 1-14. 
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sion simulators 101 or because of inadequate spare parts for the Or- 
biter, 192 

Availability of training time on simulators and availability of 
spare parts can both be improved by the application of more re- 
sources. Nevertheless, if the achievement of a planned flight rate is 
the overriding concern, removal of one bottleneck may only reveal 
another one. Eventually, pressures will be brought to bear on 
safety. The pressure on NASA to increase Shuttle flight rate has 
been complicated by the need to maintain program flexibility 
(which means to accommodate changes in the payloads on the 
manifest) and by the “developmental” nature of the Shuttle 
system. Manifest changes and the developmental nature of the 
system create problems in the planning of Shuttle missions. 

In addition, it is interesting to note that until the training, 
spares, and mission planning problems are resolved, achievable 
— гаје тау пої depend оп whether ог not Challenger 15 ге- 
placed. 


с. Impact of Pressures on Shuttle Operations 


Issue 


Did operating pressures adversely affect the safety of the Shuttle 
program? 
Findings 

1. The pressure on NASA to achieve planned flight rates was so 
pervasive that it undoubtedly adversely affected attitudes regard- 
ing safety. 

2. The pressure to achieve planned flight rates was compressing 
mission preparation as earlier missions were delayed due to unfore- 
seen problems. Had the accident not occurred there would soon 
have been a collision between planned launch dates and mission 
preparation needs which could not have been met by overtime, can- 
nibalization, or other undesirable practices. Operating pressures 
were causing an increase in unsafe practices. 

3. The schedule of payloads planned to fly on the Shuttle (the 
manifest) was frequently changed. Each change rippled through 
the NASA Shuttle organization and through the manifest and, es- 
pecially if made shortly before launch, would increase the demands 
on personnel and resources in order to achieve the planned flight 
rate. 

4. The Space Shuttle has not yet reached a level of maturity 
which could be called operational as that term is used in either the 
airline industry or the military. Each Shuttle flight is fundamen- 
tally unique, and requires unique preparations. Therefore, small 
changes in a mission can cause significant perturbations of mission 
planning and crew training. 


Recommendations 


1. The new Associate Administrator for Safety, Reliability and 
Quality Assurance must assure that any pressures to increase the 


101 Tbid., Volume I, p. 170. 
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Shuttle flight rate do not adversely influence mission preparation. 
The Associate Administrator must have the authority not only to 
stop a particular flight, e.g., at a Flight Readiness Review, but to 
stop the whole mission planning process if necessary. 

2. Where appropriate, NASA should take steps to make the mis- 
sion planning process standard and routine to reduce the time and 
resources needed to plan a mission. Before requesting more re- 
sources for the existing mission planning process (manpower, facili- 
ties, equipment) NASA should identify ways to improve the proc- 
ess. 


Discussion 


There is no doubt that operating pressures created an atmos- 
phere which allowed the accident on 51-L to happen. Without oper- 
ating pressures the program might have been stopped months 
before the accident to redesign or at least understand the SRB 
joint. Without operating pressure the flight could have been 
stopped the night of January 27. This is documented in the Rogers 
Commission report in Chapters V and VI.!?3 Specific manifesta- 
tions of launch pressure and the resultant atmosphere in the 
agency are described in detail in Section VIII of this report. 

Nevertheless, it has become clear that the Shuttle launch system 
was not functioning well and was becoming increasingly unsafe as 
flight rate was increased. This is documented in Chapter VIII of 
the Rogers Commission report. 194 

Mission Planning.—Mission planning refers to the process of de- 
fining and preparing each Space Shuttle mission. It is important to 
understand the mission planning process in order to understand 
why pressure to achieve a given flight rate could have adverse im- 
pacts. The process is lengthy, complex, and tightly interrelated. 
That is, many steps must be done in sequence, and many different 
flights have to use limited resources and facilities. 

Mission planning begins at NASA headquarters with the custom- 
er services manager in the Office of Space Flight. Both financial 
and policy agreements between NASA and the customer are nego- 
tiated and signed. Technical documentation begins at this time al- 
though the level of mission-specific work is low. 

After flight assignments are made by NASA Headquarters and 
the mission is defined, a process of continual review begins. Pay- 
loads are assigned to a particular flight 33 months prior to launch. 
At this time a Payload Integration Plan (PIP) is developed which 
includes a preliminary analysis of the mission. 

Payload safety is the responsibility of the payload developer. He 
must be throughly familiar with NASA safety requirements and 
must certify that his payload meets them. NASA audits the certifi- 
cation process but performs no visual inspection of the payload for 
conformance to safety standards. 

Once the cargo of a particular mission has been defined, or 
"baselined", the significant engineering work of mission processing 
actually begins. NASA refers to this as the "production process”. 
The product of the process is the launch of a particular mission, 


103 Ibid., pp. 82-151. 
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but there are many other intermediate products such as flight and 
training software, crew activity plans, and handbooks and check- 
lists for the crew to take on the flight. 

The launch production process template is displayed schematical- 
ly on Figure VI-2. The template begins 15 months before the sched- 
uled launch date (L-15), at which time a Flight Definition and Re- 
quirements Directive (FDRD) is issued. This marks one of seven de- 
fined "freeze points" of the 15 month mission-specific pre-launch 
activity. A freeze point simply means that a particular activity is 
norminally defined so that no time changes can occur without a 
formal process to authorize and document the change. In theory, 
non-mandatory changes are not made after a freeze point. As noted 
below, significant changes do indeed occur after the various freeze 
points in the schedule. 
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At 7.7 months before launch, the Cargo Integration Review (СІВ) 
occurs. This is a critical point in the mission definition and launch 
process. The customer participates in this review. All baseline re- 
quirements for flight design, flight and ground operations, and 
crew size are defined. The engineering requirements for a particu- 
lar mission are approved. The CIR essentially separates the design 
process and concept documentation from the actual Orbiter proc- 
essing, installation and certification of the hardware and software, 
and final crew training and engineering verification of the various 
systems on the Orbiter. Typically 10 to 20 percent of the mission- 
specific preparation work is accomplished by the time of the CIR, 
and after the CIR the process is driven by the Shuttle mission 
preparation milestones. 

At L-3 months the flight operations review (FOR) takes place. 
This freeze point allows the customer to review all final flight oper- 
ations plans. At approximately the same time the launch site flow 
review (LSFR) takes place, at which the timing and flow of the 
Shuttle and its cargo through the Orbiter processing facility (OPF), 
the vehicle assembly building (VAB), and to the launch pad are all 
reviewed and baselined. No changes should occur after this point in 
time, but, of course, some do. 

At L-2 weeks the Flight Readiness Review (FRR) takes place. Its 
purpose is to verify the fact that for this mission the hardware and 
software are ready for flight. It is here that the final commitment 
to a specific launch date and time is made. 

At the FOR typically 40 to 50 percent of the work of the produc- 
tion process has been accomplished. At the time of the Flight Read- 
iness Review, almost all of the work must have been accomplished 
because the Flight Readiness Review is not for the purpose of 
working out problems but merely to certify that problems have 
been resolved. 

As the targeted flight date approaches, conditions are continually 
reviewed and last minute changes are made as necessary through a 
series of meetngs and teleconferences. 

This simplified description does not begin to reveal the details of 
the launch production process but study of the template should 
give some indication of its complexity. With over 50 percent of the 
work typically needing to be accomplished in the last three months 
before Jaunch, and with typically 20 or more flights in work at any 
given time, it should be clear that last minute changes can be very 
disruptive and costly. 

The developmental or non-operational status of the Shuttle also 
contributed to problems as the flight rate increased. Less time be- 
tween flights meant that results from one flight could not be incor- 
porated into the early planning for the next one. In other words, 
any change resulting from feedback from the previous flight was 
necessarily a last-minute change. Because of the developmental 
nature of the Shuttle system, such changes were to be expected. At 
24 flights a year there would be about two weeks between flights. 
Allowing some time for flight data analysis, this would mean that 
results of the previous flight typically would not be available at the 
Flight Readiness Review. Indeed, the O-ring erosion results of 
flight 61-C were available only immediately before the 51-L 
launch. і 
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The complex and lengthy mission planning process was under іп- 
creasing pressure and was being strained to achieve the planned 
launch rate. Two activities that were compressed were training of 
the flight crew and training of the ground launch crew. 

Training.—When training and other preparations is compressed, 
progam quality is likely to suffer, and errors become more likely. 
Given the situation with NASA’s safety program—which the 
Rogers Commission described as "silent"—errors were less likely to 
be detected before harm could occur. Errors can be caused by per- 
sonnel taking shortcuts with respect to established procedures. Two 
examples are given in the Pre-Launch Activities Team report: 


The most significant error encountered was during the 
launch countdown. While preparing for propellant loading, 
the LH2 Orbiter to ET disconnect Valve was opened by the 
console operator. He had erroneously failed to follow the 
required steps in the OMI. A follow-on error was made in 
that this occurrence was not properly documented. Since 
proper documentation was not present, a full assessment 
of the problem was not made prior to the launch of STS 
51-L. Flight data from STS 51-L indicated the valve did 
perform satisfactorily. 

Another major error occurred when the integrity seals 
on the ET aft restraints were broken and not reported. It 
is believed that the seals were broken in error, but the 
break of integrity was not reported in accordance with es- 
tablished procedures. 

The underlying factors contributing to these errors were 
not determined during the processing reviews.!9?5 


These errors apparently had no adverse impact on the mission, 
but indicate a breakdown of the discipline so necessary for a proc- 
ess as complex as launching a Shuttle. 

Shuttle crew training is an important part of mission prepara- 
tion. The crew of 51-L had training loads as high as 70, 63, 65, 59 
and 58 hours in the several weeks before their launch. This was 
due to the fact that their training started some 3 weeks later than 
scheduled. 

It must be noted that the crew also had 3 easy weeks during this 
period. During the weeks which included Thanksgiving, Christmas 
and New Year's they only trained 31, 27 and 49 hours, respectively. 
No harmful effects of compressed Shuttle crew training have been 
documented but common sense indicates that the situation must 
have been less than optimal. 

It will be recalled that the launch of flight 61-C, which immedi- 
ately preceded 51-L, was delayed several times. It was originally 
scheduled to launch on December 18th and eventually launched on 
January 6th. The Commission report describes how the launch date 
slips for 61-C became a scheduling factor for the training through 
integrated simulations for 51-L.!95 Delay of 61-C launch pushed а 
bow wave of tests at the Kennedy Space Center which required 51- 
L prime crew and/or mission control center resources and thereby 
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constrained the time at which integrated simulation training could 
be conducted. The 51-L training schedule was changed several 
times during the last weeks prior to launch due to launch slips of 
61-C and the desire to suspend work between the Christmas and 
the New Year holidays. Eventually all 51-L training was accom- 
plished with some change of spacing between the simulations. If 
the originally planned spacing of simulation training was optimum, 
then the changed spacing probably was not. 

It is not clear exactly why the 51-L crew was late in starting its 
training, because it should have started training before the delays 
of the 61-C launch began. What is clear is that the crew training is 
a serial effort which cannot occur until software is available to 
drive the simulation computers.!?? The necessary software cannot 
be written until the specific flight configuration of the mission has 
been designed. This is a situation in which each event must wait on 
the completion of the previous one. In the case of 51-L there were 
delays and development of some software elements. But it is not 
clear that the development of these elements was in fact started on 
time. It is clear that there was considerable remanifesting of 51-L, 
for example during most of 1984 the Cargo Integration Review was 
scheduled to occur on September 4 but due to remanifesting this 
slipped and the CIR eventually occurred on June 18, 1985. In April 
1985 a major change was made when the Orbiter assigned to the 
mission was changed (from OV-104 to OV-099) and major payload 
changes were made. This caused a slip of launch date from Novem- 
ber, 1985, to January, 1986. There were small middeck payload 
changes in October, November and December of 1985.108 

It is clear that these changes must have delayed the delivery of 
software which, in turn would delay the start of crew training. 
Crew training was not related to the accident, but it does seem 
clear that the system was breaking down (i.e., data presented in 
the Commission report shows that in January of 1986 the delays in 
the projected start of crew training were growing).!9? 

Examination of the record shows that pressure to achieve the 
planned flight rate was forcing the crew to train later and later, 
which meant higher weekly training loads. This was very likely 
compromising the effectiveness of the crew training and thus the 
safety of the missions, although no harm had been documented at 
the time of the accident. 

Manifest Changes—As described in detail above, the planning of 
a Shuttle mission requires more than a year of significant work, 
with the first major “freeze point" occurring 15 months before 
planned launch. A freeze point is a place in the mission planning 
schedule where decisions are made about the mission and its imple- 
mentations. In theory, these decisions are made in a cumulative 
fashion so that earlier decisions do not have to be changed as the 
mission is refined through the planning process. Indeed, if there 
are no changes, this is in fact the way the system works; however, 
there are changes. 


197 Їбі4., р. J-38. 
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The first freeze point occurs when the mission is officially de- 
fined and payloads are assigned to a specific Orbiter. Another 
major freeze point occurs approximately seven months before 
launch at the Cargo Intergration Review (CIR). Typically, more 
than 80 percent of the work necessary to prepare a mission occurs 
after the Cargo Integration Review. Changes in the mission after 
the CIR tend to be much more expensive than changes made earli- 
er in the process.!!? The Rogers Commission has adequately docu- 
mented the fact that changes to the Shuttle manifest were common 
and major.!!! As of April, 1986, the six missions planned to follow 
flight 51-L which were not dedicated missions, і.е., not missions 
having only one customer, had a total of 30 changes or an average 
of five each after the start of the production process. Eleven of 
these changes were major that is, they involved the exchange of 
different types of major payloads.!!? 

Manifest changes can be divided into four basic categories de- 
pending on the origin of the change. Some changes are caused by 
hardware problems such as when the Tracking and Data Relay 
Satellite was found to have a problem and was deleted from flight 
51-E. As there is no reason to launch a faulty satellite, NASA vir- 
tually is obligated to allow such faulty satellites to be changed out. 

The second category of manifest change results from what could 
be called “customer request." For example, many communication 
satellites have been rescheduled at the customer's request for busi- 
ness reasons. Again, NASA is in an awkward position because if 
the satellite is not needed, NASA would not want to be in the posi- 
tion of insisting that it be launched. (Although there have been 
— when customers launched satellites and stored them оп- 
orbit. 

A third category is caused by the belated recognition of oper- 
ational constraints in the Shuttle system. For example, it has been 
found that a payload combination would exceed the landing 
weights for the transatlantic abort sites. 

In another example of this type of change, it was found that 
there was no acceptable launch window for a planned combination 
of payloads which needed to be put in different orbits. It would 
seem that NASA could improve its mission planning production 
process to minimize this kind of manifest change by doing a better 
job of assessing the impact of operational constraints on payload 
combinations earlier in the planning process. Of course, one must 
allow for the late emergence of subtle operational constraints 
which would only be discovered as a result of deep analysis rela- 
tively late in the process. Nevertheless the MPOT report suggests 
на NASA sometimes carries unworkable flights on the mani- 
est.!13 

The fourth category of manifest change is due to external fac- 
tors, many of which are totally within NASA's power to deny. It 
appears that many of the Headquarters requests for changes are 
made in order to put on the manifest science experiments which 
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are essentially payloads of opportunity. This would include the Get 
Away Specials (or GAS-cans). It has been considered highly desira- 
ble to give this kind of standby status to scientific experiments be- 
cause they have had low priority on the manifest. That is, it is a 
way for such experiments to get a relatively early flight. 

When changes are made in the manifest they tend to ripple 
through the system and affect not only the mission in work but 
also all the other missions in work. For example, changes mean 
rework—things need to be done over. Software for the mission may 
have to be rewritten. Inevitably, this causes some delay and com- 
presses the time available for other work scheduled downstream in 
the process if the launch date is to be maintained. Of course, if the 
flight rate is to be achieved, launch dates must be kept. 

Other missions are affected because the reworks necessary as a 
result of changes will pull engineers and technicians away from 
other projects. For example, in January, 1986, there were 21 flights 
in process. Given the fact that that resources available were finite, 
more work on one mission means that other missions have to wait. 
The result is that the mission preparations for the other missions 
also are compressed as they wait for the proceding mission to clear 
the process. The world system becomes less and less resilent, there 
is more and more overtime, and there is temptation to take short- 
cuts in the process. 

It is important to note that “manifest changes” can also be 
viewed as “payload flexibility” as in the case of the “GAS-cans” 
mentioned above. Therefore, there may be a need to decide more 
specifically what we intend the Shuttle system to accomplish. If 
Maximizing flight rate is to be the overriding consideration, then 
flexibility will have to suffer. However, if NASA adopts to rigid a 
posture with regard to payload changes, customers or users may 
object. For example, as pointed out above, there is no point in 
launching a faulty satellite. Most space operations are simply not 
mature enough for NASA to enforce a rigid manifest. 

It would seem that a better way to minimize the adverse impacts 
of manifest changes would be to simplify the mission planning 
process so that freeze points could be later, that is nearer to the 
launch date, so that consequently changes would occur relatively 
earlier in the process, therefore with less impact. 

Given the history of the program, it is known that there will be 
changes in the manifest and that the impact of these changes will 
be serious. It does not seem, therefore, that it would be particularly 
fruitful to try to develop analytical management tools to predict 
the impact of changes in the existing system (an effort NASA has 
suggested). Rather, effort should be directed toward developing a 
new, improved mission planning system. Also, the MPOT report 
claims that the impact of changes is already predictable, and can 
be budgeted.!!* 

Operational Status of the System.—In addition to reconsidering 
the priority which should be attached to maximizing flight rate, 
there is also a need to consider the degree to which the Shuttle 
itself can be made more “operational.” 


114 Ibid., р. 4-38. 


181 


The Rogers Commission Report makes much of the fact that the 
Shuttle is not operational.!!5 The same point was made strongly to 
Committee staff in interviews with personnel at Kennedy Space 
Center involved in launch processing. The Roger Commission made 
no recommendation on this matter and NASA in its reponse to the 
Commission has not direcly commented on it. 

As early as 1981, senior NASA officials agreed that the Shuttle 
should be brought “to a cost-effective operational status" апа that 
to that end Shuttle design should be ''frozen".116 

The Shuttle was declared operational after its fourth flight, but 
that the program clearly was not capable of functioning in a 
manner that would be called operational in any other milieu. Each 
Shuttle flight is, indeed, unique. Large amounts of software must 
be written de novo for each flight. This is appropriate for a develop- 
mental program but clearly but clearly will not work as NASA 
tries to move into a truly operational phase. 

Prior to the Challenger accident NASA had realized that the 
mission planning process had to be drastically improved, probably 
through standardization. Unfortunately, pressure to increase the 
flight rate was driving all available resources into speeding up the 
existing system. There simply were not resources available to ana- 
He the mission planning system and see where it could be simpli- 

ied. 

If the Shuttle is to fly routinely, the mission planning system 
must be reworked to that end. For example, the Commission report 
makes the point that the two flight simulators were a bottleneck in 
the astronaut training ргосезз.118 Undoubtedly this was true. 
What is not clear is whether there is another way. For example, 
would it be possible to develop specialized crews, say a group of as- 
tronauts trained to deploy communication satellites, who would 
need much less training to repeat identical or similar missions, 
thus reducing the demands on the simulators? The point is not 
that such savings must be found or can be found, but that they 
must be sought and resources must be dedicated to the search for 
such savings. If, indeed, no such standardization of mission plan- 
ning is possible, NASA must face up to this fact and operate the 
Shuttle accordingly. As mentioned above, there are disturbing 
signs that NASA is moving once again toward achieving the high- 
est possible flight rate without fundamentally changing its ap- 
proach to Shuttle operations. 

Pressure to Reduce Cost and Turn-around Time.—NASA was 
under pressure to reduce flight costs and to reduce turn-around 
time between flights. In some cases they could achieve both objec- 
tives at once by eliminating work done between flights (e.g., testing 
and refurbishment). A NASA memo shows that such actions were 
being pursued as early as August, 1981, after only one Shuttle 
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flight.!!? Attached to the memo are lists of activities to improve 
the producibility and reduce the cost of the SRB and ET. These in- 
clude reduction of “mandatory government inspection require- 
ments” for SRM processing by Thiokol and reduction of SRM pro- 
pellant verification testing. 

The point is not that these particular actions were unsafe, but 
that even very early in the flight program there were pressures on 
testing and inspection activities in the program. 

Shuttle Process Issues.—Section УІ.А.2.а. of this report, on “Shut- 
tle Processing Issues” discusses several matters such as the avail- 
ability of spares, overtine, and the adequacy of ОМБ. It is clear 
that operating pressure aggravated and issues discussed there. For 
example, had there been no operating pressure there would have 
been less pressure on spares, less overtimd, and more time either 
to revise OMIs or to execute them. 

Change Control Process.—Section УТ.В.1.4. on “Change Control 
Process’ discusses how the pressure to increase flight rate compro- 
mised the hardware change control process. An important factor is 
the developmental (i.e., not-yet-operational) nature of the Shuttle 
System which means that large numbers of significant hardware 
changes can be expected. 


d. Other Safety Issues 


Issue 1 


What is the criticality of landing safety associated with pro- 
grammed and abort landing sites and their local characteristics? 
Findings 

1. The Committee finds that many of the normal and abort land- 
ing safety problems will be alleviated when the Rogers Commis- 
sion’s and the Committee’s (section V.A.1.b., this report) recommen- 
dations to upgrade the landing gear system are implemented. 
When the landing gear system is understood, straightforward cal- 
culations and operational rules will determine acceptable runway 
dimensions and conditions. 

2. The Committee found no reason to fault NASA’s current pro- 
cedure on launch constraints based upon operational judgement 
and conservative rules on local conditions at planned abort and 
landing sites. However, since an obvious finding is that the Orbiter 
is a developmental system, it is axiomatic that unanticipated 
“dicey” circumstances will arise. 

3. It was found that for the least landing gear system stress, 
runway preference is Edwards Air Force Base (EAFB) (concrete), 
KSC, and Rogers Dry Lake (EAFB "lake bed") in that order. No 
reason was found to invalidate the KSC runway design. The rea- 
sons for the "dry" course surface still prevail over concern about 
wear on tires designed for one landing. Additional constraints at 
KSC because of lesser lateral stabilized overrun area may be 
needed to bring its safety to the level of the EAFB runway. 

4. The МАЗА Landing Safety Team's proposal to provide stand- 
ard landing aids and arresting barriers at all sites and their em- 
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phasis оп runway surface characteristics. for repetitive tire use 
takes on a new dimension that is in addition to the Rogers Com- 
mission’s recommendations. 

5. Weather, by far, is the most significant factor governing oper- 
ational decisions, Orbiter damage, and landing safety. The con- 
straint is simply that acceptable weather must be forecast with 
confidence within the time frame needed. Ultra-conservative rules 
prevail because of the predictable unpredictability of Cape weather. 
New and innovative local weather analysis and forecasting re- 
search is a high priority. The African Coast and southwestern 
United States sites enjoy more stable and predictable weather. 


Recommendations 


The first priority to achieve an acceptable degree of landing 
safety and to have a sensible base to work from for improvement is 
to implement the recommendations of the Rogers Commission and 
the Committee on the landing gear system improvement to attain 
an operational capability. Then: 

Instrument the system, and schedule all landings at Edwards 
runway for systematic concurrent testing until the landing 
gear system is understood. 

Write a clean sheet set of rules based on results. 

Determine the risk of accident with the B-747 Shuttle Carri- 
er Aircraft (SCA) and its impact upon the Shuttle program. 

Extend every reasonable effort to assure a mission planning 
process to minimize the need for abort site landings. 

Reevaluate and determine the degree of risk acceptable at 
abort site landings and bring abort site capability up to meet 
that risk level. 

Expand astronaut matched team flight landing practice to 
cover all known exigencies. Propose additional training craft if 
necessary. 

Join in a venture with NOAA to invent new technology and 
techniques to learn new ways to understand the dynamics of 
Cape Kennedy weather phenomena to supplant current inad- 
equacy to forecast two hours ahead. 


Discussion 


This discussion assumes that landing gear system improvements 
are to be implemented. The substance of the testimony and results 
of the Committee investigation are fairly clear. 

The EAFB runway will remain the primary programmed landing 
site for the duration of the Shuttle program simply because of the 
capricious nature of the Cape weather. All landing parameters 
favor Edwards runway as the best for safety and it approaches 100 
percent predictable availability. 

The safety of Rogers dry lake is permanently compromised be- 
cause of the lake bed surface. Its firmness and surface strength are 
variable and the surface has considerable debris scattered on it. 
Should the tires blow on one strut, it would dig in and the Orbiter 
would not be controllable as it would be on a concrete runway with 
nose wheel steering and brakes. This is also true of stabilized later- 
al and longitudinal overrun areas of the concrete runway. 
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From the body of testimony, it сап be deduced that given a land- 
ing gear system that meets operational requirements, acceptable 
weather, and an adequately trained pilot, the Orbiter can consist- 
ently achieve the acceptable level of low risk landings that was 
originally intended at Edwards and KSC. The worst KSC case is 
the heavy weight abort Return To Launch Site (RTLS) landing. 
Night landings at these sites add an element of risk that cannot be 
evaluted until day landing confidence is restored. The only astro- 
naut testimony on night landings was not favorable.1?° 

Landing safety at remote abort sites presents, by far, the worst 
case including all facets of navigation, weather, energy manage- 
ment, depth of pilot training, other air traffic intrusion, alignment, 
approach, heavy weight high speed landing, narrow and short run- 
ways, and fire and rescue support, and perhaps even terrorism or 
sabotage. In short, the classical emergency landing is just that—an 
emergency landing. It will surely test the skill of the pilot. The 
only sure cure for abort landing exposure is a successful launch. 

Testimony gave reference to one RTLS site (KSC), five TAL 
(Trans Atlantic or Trans Abort Site) sites (Casablanca, Dakar, 
Moron, Rota, Zaragoza), and three AOA (Abort Once Around) sites 
(EAFB, White Sands Northrop, KSC). At least one each of these 
must be available within the rules of visibility, wind, dew point, 
precipitation, ceiling, cloud cover, turbulence, and gusts, and pro- 
vide TACAN, MLS, PAPI (Precision Approach Path Indicators), 
and Ball Bar lights as deemed necessary for the mission; the RTLS 
within 25 minutes of launch, the TAL at about 35 minutes, and the 
AOA in an hour and 45 minutes. 

The Orbiter is not a good handling airplane to fly. The Orbiter 
landing is the most demanding task of airmanship expected of an 
aviator today. It is a complex and sophisticated blend of automa- 
tion, systems management, and manual skills: 

The Orbiter re-enters with a 1100 mile cross track capability 
to begin the Terminal Area Management phase, 52 miles out 
at Mach 2.5 and 82,000 feet. 

Computer energy management delivers the Orbiter to the 
alignment circle on TACAN where the pilot takes over at 
three minutes out on a 19 degree glide scope aligning on PAPI 
lights. 

y 13,000 feet, 6 miles and two minutes out, he initiates flare 
to intercept the 1.5 degree glide slope at 275 knots. 

Guiding on the Ball Bar lights, he approaches and lands 
around 200 knots depending on his weight. 

At 140 to 120 knots, he begins to brake and decelerates to a 
stop. 

If MLS terminal navigation is not available, the pilot can rely 
upon onboard radar for precision altitude and use his heads up dis- 
play to assist what is nominally a visual approach and landing. 
There is no room for computer, navigation or pilot error. Training 
aircraft training and practice is an element of major importance to 
successful Orbiter landings under the variety of conditions facing 
the pilots. Unrationed crew team flight training is deemed essen- 
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tial to landing safety. Conversely, suggested autoland systems for 
this application did not find much support because they would pose 
a whole new development and certification hazard. 

Landing safety will make a lot more sense if and when the cloud 
of imminent landing gear system failure is dissipated. That has 
been a pervasive note through the entire testimony and investiga- 
tion. 


Issue 2 


Has adequate provision been made for crew safety in case of in- 
flight emergencies? That is, has adequate provision been given to 
launch abort options and crew escape options? 


Findings 


1. Crew escape options were considered when the Shuttle was 
originally designed and the basic situation has not changed. Many 
initially attractive options do not significantly reduce risk to the 
crew either because they may not reduce exposure to the principal 
hazards or because they add risks of their own. 

2. A crew escape system for use in controlled gliding flight might 
be feasible and worthwhile. 

3. Crew escape during the ascent phase appears infeasible. 

4, Launch abort during SRB burn appears impossible but it may 
be possible to decrease risk to the crew after SRB separation, pri- 
marily through mission design. 


Recommendation 


NASA should continue to respond to the recommendations of the 
Rogers Commission regarding (i) crew escape during controlled 
gliding flight and (ii) increasing the possibility of successful emer- 
gency runway landings. NASA should re-examine all crew survival 
options and report to the Committee on its findings. 


Discussion 


Before addressing the particulars of the findings and recommen- 
dations regarding launch abort and crew escape a few general com- 
ments on safety and risk will establish a useful framework. 

Any new safety equipment installed on the Orbiter will bring 
with it its own new risks. It will also add weight to the Orbiter and 
will have associated capital and operating costs. Each of these must 
be addressed. 

New Risks.—Consider for example the possibility of adding ejec- 
tion seats to the Orbiter. The United States Air Force experience 
with ejection seats has been that they are only about 80 percent 
effective.!?! The point is that ejection seats are not a panacea. Any 
safety equipment has a chance of failing; ejection seats in particu- 
lar always have a potential of premature activation which would 
result in the crew being ejected when there is no need. 

Additional Weighit.—In order to accomplish its purpose, the 
Shuttle must put payloads, i.e., weight, in orbit. Adding weight to 
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the Orbiter reduces the payload weight that can be orbited and 
therefore reduces the justification for the program. This is perhaps 
made clearer by considering a reductio ad absurdum. Suppose one 
could develop a new escape system—perhaps an ejection pod which 
could reduce risks to the crew by 90 percent but weighed approxi- 
mately 65,000 pounds. Since the Shuttle payload capability is only 
about 65,000 pounds there would be no remaining payload capacity 
in the Shuttle, and some risk would still remain. There would be 
no point to installing such a system because it would be a very bad 
trade. Evidently, one must do an engineering cost-benefit calcula- 
tion and decide if the benefit is worth the penalty for each pro- 
posed change. 

New Costs.—The same type of cost-benefit calculation must be 
done in the financial dimension. It is important to emphasize that 
the question is not “how much is a life worth?," but rather “where 
can an extra amount of funding best be spent to reduce total risk 
to the crew, the mission, and the Orbiter?” 

Risks will never be zero—what NASA must do is to better under- 
stand the risks and minimize the most dangerous exposures. 

The risk, cost and weight penalties of crew escape systems that 
could hope to operate effectively while the SRB are thrusting are 
very large. This dictates that it is much more efficient to put pro- 
gram resources into reducing risks by improving the reliability of 
the SRB’s and the whole Shuttle system during the period of time 
that the SRB’s are thrusting. For example, if one of the SRB’s 
should develop a problem so that there was a need to separate the 
Orbiter from the SRB’s and External Tank, it is essentially impos- 
sible to do this successfully while the SRB’s are still thrusting. 
There are potential means of terminating SRB thrust which 
amount to explosively opening holes in the rocket casing. The holes 
allow the burning gases to exit the casing at several places so that 
there is no net thrust. Such a mechanism has the potential of pre- 
mature activation which could lead to loss of the crew and the mis- 
sion. In addition, the resulting deceleration loads on the Orbiter 
would require significant redesign, if the Orbiter were to sur- 
vive, 122 

A large part of the problem is that the launch situation is very 
dynamic. Decisions and implementation of decisions must be made 
very rapidly. The decisions are binary; that is, either “ро” or “no- 
go,’ and the implementation must be largely automated for speed 
of execution. Thus, if a premature activation begins it will almost 
certainly go to completion. 

In the case of 51-L accident, the first ambiguous indication of a 
problem came at about 65 seconds into the mission. At 72 seconds 
the system was coming apart and by 74 seconds the Orbiter was 
destroyed. The first signs of trouble were ambiguous because indi- 
cations that the Orbiter was adjusting to aerodynamic forces due to 
the leak in the SRB joint appear very similar to signals generated 
when the Orbiter responded to upper atmosphere winds. It would 
be very risky to initiate any kind of crew escape action based on 
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this sort of signal. The Solid Rocket Boosters began coming off the 
system at 72 seconds, after which an escape system might well 
have been inoperable due to mechanical deformations of the Orbit- 
er structure under the aerodynamic loads that resulted. Thus, 
there was a period of time of something less than 9 seconds during 
which some kind of escape system might have been able to help the 
crew. It seems clear that attempting to develop a system to respond 
effectively to a situation such as this would be unproductive and 
that it would be wiser to improve the safety and realiability of the 
system during this ascent phase. 

After the termination of SRB thrust, immediate crew escape is 
difficult because the Orbiter has achieved a very high altitude. 
However, under a range of circumstances it is possible to fly the 
Orbiter back to a controlled gliding landing at a runway. Under 
other circumstances, for example if the main engines fail shortly 
after SRB termination, the Orbiter may be forced to ditch into the 
ocean and such a ditching is not survivable. 

Therefore the Rogers Commission recommended, and the Com- 
mittee agrees, that NASA should attempt to minimize these risks. 
That is, NASA should take steps to increase the probability of the 
Orbiter being able to fly to a landing site and NASA should at- 
tempt to develop a way for the crew to escape from controlled glid- 
ing flight, for example, if the Orbiter is approaching a ditching or a 
crash landing. 

After SRB termination a principal risk is that the Orbiter could 
lose one, two or three main engines. Depending on when and how 
this occurred it might be possible to fly the Orbiter to a landing 
site. It may be possible and perhaps practical to increase the proba- 
bility of the Orbiter successfully accomplishing this maneuver 
through flight design. That is, it might be possible to accept some- 
what reduced payloads and achieve more conservative trajectories 
which would minimize the exposure of the Orbiter to ditching or 
crash landing if main engine failure were to occur during the 
accent phase. 

If the Orbiter finds itself in a situation (due to Main Engine fail- 
ure or other failure) where it cannot fly to a runway but is other- 
wise under control, the crew might be able to escape during the 
controlled gliding descent. This would apply not only during the 
ascent phase but also during the landing phase. For example, if the 
reentry trajectory were miscalculated and the Orbiter could not 
reach the planned landing site the crew might have adequate time 
to bail out. There is a change that such a bailout system could be 
achievable with acceptable performance penalties. Certainly this 
last option—crew bail-out during gliding flight—must be very саге- 
fully studied. 

The trade offs and calculations that have to be made in the area 
of crew escape and launch abort are activities in which astronaut 
involvement would be most useful. 

Astronauts clearly represent the principal source of flight experi- 
ence and tnerefore can make major inputs to decisions regarding 
what is practical to accomplish during flight. It is pointless to add 
risks, weight, and cost for a system that cannot be operated by the 
astronauts during flight conditions. Involvement of astronauts in 
management is discussed in section VI. B. 2. a. of this report. 
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In summary, space flight will always be а bold and dangerous 
venture. NASA must work to better understand the risks of space 
flight and in particular the risks of each Shuttle launch and to 
reduce these to an acceptable level. 


В. MANAGEMENT ISSUE 


1. TECHNICAL MANAGEMENT 
a. Risk Management Issues 


Issue 


There a coordinated and effective risk management program in 
the NSTS? 


Findings 


1. NASA does not explicitly use a centralized program that co- 
ordinates all the factors that encompass an adequate risk manage- 
ment program. 

2. As a result of the accident, NASA is reexamining the Failure 
Modes and Effects Analyses (FMEA) and Hazard Analyses (HA) to 
reassess risks associated with the designs of Shuttle subsystems. 

3. NASA’s lack of statistical data on the performance of certain 
components will limit the usefulness of sound engineering judg- 
ment in much the same way as it limits the usefulness of probabi- 
listic risk assessment. 


Recommendations 


1. NASA should develop and provide to the Committee a descrip- 
tion of an overall risk management program as it relates to the 
Space Shuttle. This effort should include a determination of wheth- 
er or not a more centralized coordination of a risk management 
program and issuance of direct risk management guidance direc- 
tives are needed. 

2. NASA should review analytical methods utilized in the per- 
formance of risk assessment, including statistical analyses, trend 
analyses and probabilistic risk assessment methodologies to deter- 
mine their applicability to the NSTS program. Assistance from the 
National Academy of Sciences, or other appropriate organizations 
with expertise in these matters, may be required to adequately per- 
form this review. 

3. NASA should review its certification testing to ensure that all 
critical items are adequately tested. Data obtained from these tests 
should be used when appropriate in conducting a formal risk as- 
sessment. 


Discussion 


NASA does not have a specifically labeled risk management pro- 
gram. The process is accomplished by the agency through its con- 
figuration management program and the FMEA performed on each 
component of the Space Shuttle. The identification of critical items 
is the principal product of these analyses. The ability to make the 
programmatic or engineering changes necessary to enhance the 
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safety and performance of flight systems while controlling costs 
and schedule is the task of the risk management activity. 

The process of risk management as applied to systems such as 
the Shuttle can be described schematically as shown in Figure VI- 
3,123 which shows the various steps that might be imposed upon 
flight systems such as the Shuttle through a risk management pro- 
gram. 


123 Douglas В. Feaver, “Success Relaxed NASA's Vigilence", Washington Post, May 26, 1986, 
pp. A-1, А-10. 
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Тор NASA managers lack а clear understanding of risk manage- 
ment. Dr. Fletcher, NASA’s Administrator, made the following 
statement, when asked by Mrs. Lloyd to “describe the elements of 
NASA's risk management activities . . .”: 


Well, risk management is a pretty generic term. Risk 
management is decided in Headquarters in terms of what 
are the chances of an overall failure of a system under a 
given set of circumstances. When you get down to the 
flight team, the launch crew in those last several hours or 
couple of days, risk management is an entirely different 
thing. They have to look at the factors that have come up 
just before launch and assess whether this is a risk we 
want to take. This is a judgement question; you can't make 
calculations at this point.!?* | 


UE Silveira, NASA's Chief Engineer, testified on the same day 
that, 

As we had mentioned in the testimony that we gave pre- 
viously . . ., the only time that we had gone into trying to 
assess a probability, if you will, or a risk, was as a result of 
a request that was made by DOE for their analysis that 
they were performing at that time, to assess the probabili- 
ty of failure of the vehicle, to assess the danger when we 
are flying the RTG's, the radioactive material. 

As far as in our program, and any major decisions that 
we would make, we have a number of reasons why our 
past history had indicated that that was not a good way of 
doing it. As a result, we don't use it generally in our risk 
management, we prefer using things like the failure ef- 
fects and analysis that we do; the technical engineering 
judgement, using things to control our failures rather than 
depending upon a probability analysis to assess 14.125 


However, Mr. Robert Thompson, who was Shuttle Program Man- 
ager from 1970 to 1972, testified on July 24th before the Committee 
in a much less ambiguous fashion regarding his view on the impor- 
tance of risk management: 


I would first like to make an observation on the deci- 
sionmaking process. Evidence, in retrospect, points to a 
long period of time, especially based on post-flight inspec- 
tions when the joint design weakness was 'sending a mes- 
sage' and the true potential of this message was not per- 
ceived and reacted to. 

This, combined with perlaunch discussions between Mar- 
shall and Thiokol, points out the need that must pervade 
the Shuttle management team in the future. A very strong 
risk management ... І have parentheses around risk 
management. I will be happy to expand on that. It has a 
certain meaning to me. А very strong risk management or- 
ganization must be kept in place and a continuing search 
for potential failures must be maintained... . 


124 Cmt Hgs, Transcript, June 12, 1986, p. 186. 
125 Ibid. p. 187. 
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The role of the program manager іп this risk manage- 
ment organization must be very strong and clear. The 
entire program organization from top to bottom must be 
clearly chartered and as people come and go these organi- 
zational relationships must be carefully maintained.!?$ 


Based upon the divergences of these testimonies, the Committee 
concluded that although NASA’s Space Transportation System pro- 
gram contains the elements of a risk management program, there 
needs to be a new and heightened coordination of the separate ac- 
ы by NASA in order to minimize the risks inherent in Shuttle 

ights. 

The FMEAs determine the worst case “What if" scenarios for all 
possible failure modes and their potential worst case or intended 
effects.!?" As a result of performing the FMEA, a list of critical 
items is identified. NASA's FMEA assure that all Criticality 1 and 
1R systems are properly identified and classified. The failure of 
these items would produce loss of life and/or loss of vehicle. The 
FMEA applies strictly to the hardware associated with the NSTS 
and is “bottoms-up’” analysis, іп which a single component failure 
is traced and its effect on a particular subsystem, subsystem inter- 
faces, and the overall flight systems is determined. Accompanying 
the FMEA is the Hazard Analyses (HA) which is, according to 
NASA, a “top-down” approach that takes into account human fac- 
tors in evaluating the consequences of particular accidents or acci- 
dent scenarios. Hazard Analysis is the basic tool of the safety eval- 
uation. 

The FMEA as used by NASA assigns no probability numbers to 
event sequences along a given failure path. Although NASA re- 
gards the methodology of FMEA as rigorous, within the agency 
there was a wide variation in the engineering judgments among 
the design engineers and senior management in the NSTS program 
on the probability of failure of the Shuttle.!?? The Committee, in 
hearings held earlier this year related to the safety aspects of the 
Shuttle Centaur in its utilization of Radioisotope Thermoelectric 
Generators on board the Shuttle spacecraft, also found wide dis- 
crepancies in the estimate of the failure probability for the Solid 
Rocket Booster among the experts.! 29 

NASA has rejected the use of probability on the basis that such 
techniques are insufficient to assure that adequate safety margins 
can be applied to protect the lives of the crew. They also argue that 
their problem correction procedures preclude the establishment of 
a sufficient statistical database, because once a single point failure 
has been identified through the FMEA, steps are taken to design 


126 Thid., July 24, 1986, р. 106. 

тат ft is the prime responsibility of the design engineers working with reliability analysts to 
perform the FMEA in accordance with guidelines established in NASA documents (Appendix 
VI-C). These documents are provided as part of each statement of work submitted to the con- 
tractor. From such FMEAs, a Critical Items List is established in which particular components 
under the responsibility of the contractor are categorized in accordance with their criticality to 
the mission, crew, and/or spacecraft. Included as Appendix VI-D is NASA's document 100-2G 
entitled Reliability Desk Instruction, Flight Hardware Failure Mode and Effects Analyses 
(FMEA) and Critical Items List (CIL). 

128 Rogers Commission Report, Volume II, p. F-4. 

129 Hearing before Subcommittee on Energy Research and Production and Subcommittee on 
Space Science and Applications of the Committee on Science and Technology, 99th Cong., 2nd 
Sess., March 4, 1986 (No. 97). "Review of RTG Utilization in Space Missions." 
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the safety features into the component, thereby eliminating the 
failure mode or establishing sufficient redundancy to preclude cata- 
strophic failures associated with the particular component. This 
change of the component means that earlier data no longer apply. 

On the other hand, with respect to certification testing of the 
Space Shuttle Main Engine, NASA seems to argue that a useful 
statistical data base can be generated even though the configura- 
tion of the engine is changed as data is accumulated. That is, as 
running time is accumulated in SSME certification testing, major 
components—e.g., the high pressure turbopumps—are replaced, 
and yet NASA seems to believe that the total accumulated running 
time has some meaning for determining engine life Яте. 130 

All subsystems of the NSTS are intended to meet design require- 
ments that incorporate the fail-safe features as a minimum with 
fail-operational/fail-safe criteria placed on all Orbiter avionics sys- 
tems.!3! Fail-safe requirements are defined as designs which can 
withstand a single failure and permit return of the crew to the 
ground safely. Fail-operational/fail-safe is defined as permitting 
two sequential failures while enabling crew return. There are some 
parts of the NSTS which must be exempted from meeting these cri- 
teria. The reason is that it is not possible to improve the safety fea- 
tures of these systems through redundancy or other means. Such 
systems are the primary structure, the thermal protection system, 
pressure vessels and the premature firing mode of the pyrotech- 
nics. For example, the pressure vessel cannot be provided with re- 
dundancy in a safe manner because addition of another pressure 
vessel would only enhance the failure probability or the criticality 
of this component. 

The ЕМЕА is a very conservative analysis according to NASA 
since it provides information on worst case situations of all possible 
failure modes and the potential worst case effects. Even so, the 
Committee was unable to determine the degree to which flight 
anomalies and trend analyses in historical performance data are 
utilized to insure that the appropriate measures are taken in the 
design and testing of various critical components to assure ultimate 
safety and minimization of risk. 

NASA is presently reviewing the 748 Criticality 1 items and the 
1,621 Criticality 1R items. Based upon a series of tests and analyses 
and the availability of methods and instrumentation to detect prob- 
lems associated with various Criticality 1 and 1R items, waivers 
are given to permit flight of critical items. Before a waiver is grant- 
ed, according to NASA, extensive documentation and review of 
each item on the Critical Items List (CIL) for which a waiver has 
been applied must be undertaken and approved all the way 
through Level 1 management. There is a difference between the 
number of waivers granted and the total number of items on the 
Critical Items List. For Criticality-1 items this difference reflects 
the number of systems exempted from the criteria of fail-safe or 
fail-operational/fail-safe. NASA, however, does not distinguish in 
its quality control procedure between exempted items and those 
items which are not exempt from the waiver process. According to 


130 Rogers Commission Report, Volume ЇЇ, рр. К25-26. 
13! NASA Briefing on July 10, 1986. 
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NASA, this categorization of exempt versus waiver is strictly а 
management technique for identifying components and systems on 
the Space Shuttle in terms of their safety compatibility. 

The Committee finds the FMEA to be an appropriate method for 
identifying the Critical 1 and 1R elements of the NSTS; however, 
not all the elements so identified pose an equal threat. Without 
some means of estimating the probability of failure of the various 
elements it is not clear how NASA can focus its attention and re- 
sources as effectively as possible on the most critical systems. 
Moreover, waivers can be granted without assurance that an ade- 
quate level of safety has been achieved. 


b. Launch Decision Process 


Issue 1 


Is the process for establishing launch constraints and dealing 
with them effective? 


Findings 

1. There is no clear understanding or agreement among the vari- 
ous levels of NASA management as to what constitutes a launch 
constraint or the process for imposing and waiving constraints. 

2. Launch constraints were often waived after developing a ra- 
tionale for accepting the problem rather than correcting the prob- 
lem; moreover, this rationale was not always based on sound engi- 
neering or scientific principles. 


Recommendations 


1. NASA should establish rigorous procedures for identifying and 
documenting launch constraints. The individual(s) responsible for 
implementing this procedure should be clearly identified, and well 
defined and understood criteria for waiving the constraints should 
be established. 

2. NASA should exercise extreme caution in waiving launch con- 
straints before correcting the problem that led to the launch con- 
straint. The rationale should be based on rigorous scientific/engi- 
neering analyses or tests and should be understood and accepted by 
the Program Manager. 


Discussion 


No single system exists for establishing and dealing with launch 
constraints within the Shuttle Program; for example, Marshall 
maintains their own system through their Problem Assessment 
Center (PAC) to deal with problems affecting the propulsion 
system. In testimony before the Rogers Commission, Mr. Mulloy ex- 
plained that the system was established to provide visability for 
problems relating to the propulsion system and a "launch con- 
straint" was in effect a flag to alert the Project Office to address 
the problem at the Flight Readiness Review. 


A launch constraint means that we have to address the 
observations, see if we have seen anything on the previous 
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flight that changes our previous rationale, and address 
that at the Flight Readiness Review. 132 


The NSTS Program Manager stated that he was unaware that a 
launch constraint had been imposed as a result of the O-ring ero- 
sion. Unawareness of this launch constraint was also claimed by 
the Level I Program Office and key Thiokol personnel: Mssrs. Ebel- 
ing, Kilminster, Russell, McDonald, and Boisjoly.!3? 

In staff briefings, it was suggested by NASA personnel that per- 
haps "launch constraint" was a poor choice of words to describe 
this process for flagging problems. Those individuals who claimed 
no knowledge of a launch constraint had certainly been made 
aware of the O-ring erosion problem. This problem and the resolu- 
tion had been discussed throughout the system including the FRRs. 
Therefore, although it is difficult to understand why the Program 
Manager and others weren't more familiar with the Marshall PAS, 
as a practical matter it probably had little effect on the final deci- 
sions. These "launch constraints" were potential problems that had 
to be resolved prior to flight and the Level III Project Managers 
were responsible for resolving any problems dealing with their sys- 
tems. During the Rogers Commission hearings, Mr. Mulloy ac- 
knowledged that he had ultimate responsibility for waiving the 
launch constraints and ultimate responsibility for the launch readi- 
ness of the Solid Rocket Boosters. 

Although the O-ring erosion continued to occur, and with no ap- 
parent pattern, the SRB Project Manager repeatedly waived the 
launch constraint. Throughout the Rogers Commission hearings 
and the hearings of the Committee on Science and Technology, 
NASA witnesses continually justified their decision to continue 
flying the Shuttle based on their previous successful flights. This 
reliance on their "experience base" was a major factor in the re- 
peated waivers of the Marshall imposed launch constraint on the 
SRBs. Chairman Rogers asked Mr. Mulloy what was meant by “ад- 
dressing" the problem, and Mr. Mulloy responded: 


I mean present the data as to whether or not what we 
have seen in our most recent observation, which may not 
be the last flight, it may be the flight before that, is within 
our experience base and whether or not the previous anal- 
yses and tests that previously concluded that was an ac- 
ceptable situation is still valid, based upon later observa- 
tions.!?* 


Mr. Mulloy also explained his reliance on the experience base in 
testimony before the Science and Technology Committee: 


That was presented to me as a rationale to continue 
flying, one we had seen it on STS-2, what we saw on the 
last flight wasn't as bad, therefore it was an acceptable 
risk.139 


132 Rogers Commission Report, Volume У, р. 1513. 

133 Thid., р. 1590; note: Yet it was Mr. McDonald who wrote a letter to the SRB Project Office 
recommending that the O-ring problem be dropped from the Problem Assessment System (PAS), 
which was in fact equivalent to removing the launch constraint. 

134 Rogers Commission Report, Volume V, p. 1518. 

135 Cmte Hgs, Transcript, June 17, 1986, p. 151. 
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The Committee concurs with Dr. Ееуптап 8 analysis that NASA 
had no understanding of the O-ring erosion phenomenon, and their 
басу for accepting it was not based on sound engineering ргіп- 
ciples. 


. . . The acceptance and success of these flights is taken 
as evidence of safety. But erosion and blow-by are not 
what the design expected. They are warnings that some- 
thing is wrong. . . . The fact that this danger did not lead 
to a catastrophe before is no guarantee that it will not the 
next time, unless it is completely understood. ... The 
origin and consequences of the erosion and blow-by were 
not understood . . . officials behaved as if they understood 
it, giving apparently logical arguments to each other often 
depending on the “success” of previous flights.!?$ 


Issue 2 


Are the launch commit criteria procedures adequate to ensure 
the safety of the mission? 


Findings 


1. The procedure used for developing launch commit criteria is 
systematic and thorough; however, violations of the criteria do not 
necessarily mean “по go’. Therefore, NASA sometimes relied on 
engineering judgments made during the terminal countdown in de- 
termining whether to launch. 

2. Launch commit criteria were sometimes waived without ade- 
quate engineering analysis or understanding of the technical rea- 
sons for establishing the criteria. 


Recommendations 


1. NASA should review the launch commit criteria procedures, 
especially those for dealing with violations, to lessen the reliance 
on engineering judgments under stress. 

2. When situations arise where “геа! time" engineering judg- 
ments are unavoidable, NASA should adopt a more conservative 
approach to waiving previously established criteria. In no case 
should a criterion be waived without a thorough understanding of 
the rationale for the establishment of the criterion. 


Discussion 


Launch commit criteria define limits on specific system param- 
eters which are required to be monitored during the terminal 
countdown. When these limits are exceeded the launch is held 
until the condition is corrected ог an acceptable alternate capabil- 
ity or procedure is instituted. 

Proposed criteria are developed by NASA and contractor person- 
nel and are submitted to the NSTS Program Office for review and 
disposition. All changes are controlled by the Level II PRCB (Pro- 
gram Requirements Change Board) and all launch commit criteria 
are reviewed prior to each flight at the launch site flow review (8 
weeks prior to launch), the Flight Readiness Review and the L-1 


136 Rogers Commission Report, Volume II, p. F-1. 
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review. Where practical Launch Commit Criteria include pre- 
planned decisions on courses of action to be taken when violations 
occur. 

The process described for developing and controlling the launch 
commit criteria is systematic and thorough; however, in briefings 
by NASA personnel it was learned that it is not uncommon to ex- 
perience violations of the specified limits. These can often be re- 
solved in a straight forward manner based on a prior plan of 
action; however, the Committee is concerned that in those situa- 
tions where no preplanned course of action is available, real time 
engineering decisions are being made under the stress that is in- 
herent in a pre-launch environment. This is particularly undesir- 
able when it is perceived that there are pressures to launch. 

For example, it was learned that on the morning of the sched- 
uled launch of STS 51-L the Mission Evaluation Room (MER) Man- 
ager requested a waiver of the Launch Commit Criteria lower limit 
of 81 degrees F.!?" The Flight Director can not unilaterally waive 
launch commit criteria and since the temperature at launch was 
above 31 degrees it became unnecessary to pursue the matter fur- 
ther. Had it been necessary to waive the criterion, the Flight Direc- 
tor would have advised the Program Manager who then would 
have orally polled the Project Managers before making the final 
decision. One can only conjecture at this point what the decision 
would have been; however, the Committee is concerned that at 
least two key managers in the decision making chain (i.e. the MER 
Manager and the Flight Director) were prepared to waive the crite- 
rion without thoroughly understanding it. 


Issue 9 


Are the launch readiness review procedures and communications 
adequate? 
Finding 

The Committee finds that the review procedures and communica- 
tions used to assure flight readiness were systematic, thorough, and 
comprehensive and provided ample opportunity for surfacing hard- 
ware problems prior to flight. Level I FRRs are usually recorded 
(audio); however, there is often no record made of other key pre- 
launch meetings. 


Recommendation 


NASA should make every reasonable effort to record meetings 
where key decisions might be made; in particular, all formal Flight 
Readiness Reviews, including the L-1 and the Mission Manage- 
ment Team meeting should be recorded, where feasible by video. 


Discussion 


The Flight Readiness Review process encompasses a series of re- 
views beginning with contractor reviews of their systems, and 
going through the Project Management review (Level Ш), and 
NSTS Program Management review (the “Рге-ЕКК”), and culmi- 


137 Rogers Commission Report, Volume II, рр. J22-23. 
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nating in the Level І (Headquarters) review which is referred to as 
"the" FRR. One additional formal review takes place 24 hours 
before launch and is called the “L-1” review. This is conducted by 
the Mission Management Team (MMT) which is appointed by the 
Associate Administrator for Space Flight at the time he calls for 
the FRR. All open work and action items identified at the FRR are 
closed out at the L-1. In addition to conducting the L-1 review, the 
MMT functions as a technical advisory body for the Program Man- 
ager and is on call beginning 48 hours before the launch until after 
the mission is completed and the Orbiter is safed. 

The Committee concurs with the Rogers Commission that NASA 
should record key pre-launch meetings; however, the Committee 
finds no basis for concluding that the Flight Readiness Review pro- 
cedure is flawed; on the contrary, the procedure appears to be ex- 
ceptionally thorough and the scope of the issues that are addressed 
at the FRRs is sufficient to surface any problems that the contrac- 
tors or NASA management deem appropriate to surface. However, 
the Flight Readiness Reviews are not intended to replace engineer- 
ing analysis, and therefore, they cannot be expected to prevent a 
flight because of a design flaw that management had already deter- 
mined represented an acceptable risk. In addition all the appropri- 
ate offices, including the Chief Engineer representing SR&QA, are 
represented at the FRRs. Specifically, from the first evidence of O- 
ring erosion to the final decision to launch 51-L, the process pro- 
vided ample opportunity to review and assess the severity of the 
problems; moreover, all levels of NASA management were made 
aware of the erosion.!?5 However, a process is only as effective as 
the responsible individuals make it. For example, see section VI 
B.2.c. on the weakness in the SR&QA organization. 


Issue 4 


Was the failure to inform the Level I or Level II Program Man- 
agers of the Teleconference involving NASA and Morton Thiokol 
on the eve of the launch a factor in the decision to launch? 
Findings 

1. The Committee finds that Marshall management used poor 
judgment in not informing the NSTS Program Manager or the 
Level I Manager of the events that took place the night before the 
launch, specifically the stated concerns of the Thiokol engineers. 
However, the Committee finds no evidence to support a suggestion 
that the outcome would have been any different had they been 
told. 

2. The Committee finds the efforts of Thiokol engineers to post- 
pone the launch commendable; however, Thiokol had numerous op- 
portunities throughout the normal flight readiness process follow- 
ing flight 51-C in January, 1985 to have the new minimum temper- 
ature criteria established. 


138 Ibid., pp. H1-97. 
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Discussion 


The management of the Shuttle Program has given the responsi- 
bility for the Solid Rocket Boosters to the Marshall Space Flight 
Center. It is the Marshall Center that contracts with Thiokol for 
the hardware and related services pertaining to the SRBs. The 
NSTS Program Manager relies on the Marshall management and 
technical expertise for issues relating to the SRB and it is unrea- 
sonable to expect him to take technical advice from the contrac- 
tor’s engineers. This position is supported by the actions taken by 
Mr. Aldrich and Mr. Moore with regard to the Rockwell concerns 
over 1се.139 Unlike the SRB situation where the Thiokol managers 
gave a written positive recommendation for launch, the Rockwell 
managers refused to give an unqualified go for launch; yet Mr. Ald- 
rich asked for and accepted the recommendations of the Orbiter 
Project Manager and the Directors of Engineering at JSC and KSC. 
The Committee finds no evidence to suggest that in the instance of 
the Thiokol engineers’ concerns, either Mr. Aldrich or Mr. Moore 
would have disregarded the recommendation of the technical man- 
agers with the expertise in solid rockets (i.e. Marshall and Thiokol) 
and relied instead on their own assessment of the engineers’ con- 
cerns. 

Launch commit criteria and launch constraints should be estab- 
lished well in advance of a scheduled mission and should be based 
on rational, scientific and engineering arguments, including previ- 
ous flight experience. Thiokol engineers based their arguments for 
a 58 degree temperature criteria on the fact that this was the cold- 
est temperature experienced to date and they had experienced 
severe (but not necessarily the worst) erosion on that flight. Howev- 
er, a test firing had been conducted at 40 degrees joint temperature 
which resulted in по joint problems (technicians had "tamped" the 
joint putty before the test, however, a procedure not used on flight 
hardware). Moreover, it was pointed out in the hearing that this 
flight had occurred a year earlier and no mention had been made 
of changing the temperature criteria for launch. 


Mr. VOLKMER. But in all of the memorandums, et cetera, 
that had occurred before—in-between the time, January 
1985 and January 1986, you don’t specifically say 
that. ... 

Mr. Воізгогу. That is right, . . . It was nobody’s expec- 
tation we would ever experience any cold weather to that 
degree before we had a chance to fix it again, so that basi- 
cally is why it wasn’t pursued any further than that from 
my personal standpoint.!*9 


That was later questioned by Mr. Nelson in remembering that 
flight 61-C (the flight just prior to 51-L) had been scrubbed four 
times for reasons unrelated to temperature when the temperatures 
were less than 53 degrees during several of those scrubs, reaching 
down into the low 40s during the first scheduled launch. 


139 [bid., Volume I, pp. 114-17. 
149 Cmte Hgs, Transcript, June 18, 1986, рр. 83-84. 
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Mr. NELSON. . . . and so my question is, did any of these 
same concerns with the temperature come up in discus- 
sions during the final checks before those attempted 
launches? 

Mr. McDoNAr». I am not aware that they had, Congress- 
man. І don't know. I wasn't at that launch, but I don't 
recall that that came up.!*! 


Mr. Nelson later asked the Commander of 61-C, Cdr. Robert L. 
Gibson, whether he recalled any discussion among management or 
any of the contractors regarding the desirability of launching in 41 
degree weather; Commander Gibson also recalled no special con- 
cerns regarding temperature. ! *? 

Mr. Packard also questioned Mr. McDonald about the tempera- 
ture during earlier attempts to launch 51-L and asked whether in 
fact it had been below 53 degrees during some of those attempts. 
Mr. McDonald replied, “That is correct", and when asked whether 
temperature had been discussed at those times, Mr. McDonald said, 
"No, it was поў. . . Nowhere was it, no." Mr. Packard also asked 
why, in Mr. McDonald's judgment, temperature had not been dis- 
cussed in as much as the temperature was below what they be- 
lieved to be safe, and Mr. McDonald answered, "1 don't—I can't 
answer that." !43 

Mr. Packard also noted the delay in evaluating the effects of 
temperature, quoting from Mr. Kilminster's testimony, “Аз launch 
was scheduled for early the next day, our engineers immediately 
commenced evaluating the available data." He asked why they 
waited until the night before the launch to begin even considering 
the whole question of O-ring resiliency and O-ring problems under 
cold weather conditions. Mr. Kilminster replied that this was in re- 
sponse to a specific request by NASA.!44 

This indicated that the concerns and recommendations of the 
Thiokol engineers were solicited by NASA, and in as much as they 
had not come forth with the recommendation for a higher mini- 
mum temperature criterion on earlier occasions when it was 
planned to launch at temperatures below 53 degrees, it is unlikely 
that this recommendation would have been made on this occasion 
without the specific inquiry by NASA. 

The Committee finds no evidence that new data were presented 
during the January 27th teleconference that were not available to 
Thiokol at the time of the Flight Readiness Review. Moreover, the 
information presented was substantially the same as that present- 
ed at the August 19th briefing (see Section VIII) at which time they 
had recommended that it was safe to fly as long as the joints were 
leaked checked to 200 psi, were free from contamination in the seal 
area and met O-ring squeeze requirements. No mention was made 
of a temperature constraint at that time or anytime between then 
and the January 27th teleconference. 

The Committee finds that Thiokol's advice and recommendations 
to NASA were inconsistent, and therefore, the arguments present- 


141 Ibid., р. 98. 

142 Ibid., June 25, 1986, р. 78. 
143 Ibid., June 18, 1986, р. 100. 
144 Ibid., р. 101. 
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ed during the January 27th teleconference might not have been as 
persuasive at the time as they now appear to be in hindsight. 


Issue 5 


Do the principal contractors have an appropriate role in the 
launch decision making process? 


Finding 
Тһе principal contractors have an active role throughout the de- 
cision making process right up to the launch; however, the look of 


a firm requirement for their concurrence at the time of launch 
does partially relieve them of responsibility for mission success. 


Recommendation 


Principal contractors should be required to make a clear, unam- 
biguous statement concerning launch readiness just prior to 
launch. 


Discussion 


Participating contractors are required to sign off prior to launch 
that their flight system or facility is ready to support the flight. 
This is generally a one-time requirement for a given mission and 
although they are orally polled prior to the flight, they are not gen- 
erally required to make any additional written positive commit- 
ment for a "go" prior to launch. Mr. Richard Davis, President, 
Martin Marietta Michoud Aerospace, explained: 


Up to and including the L-minus-one-day review, there's 
no doubt that every company has a very strong voice; and, 
as a matter of fact, at the L-minus-one-day review, they 
are required to stand up and commit their hardware as go 
or no-go. And those are very unequivocal commitments, 
also. After that time, then the reviews are more mission 
management meetings that are held, and as you get down 
into the countdown, it turns into more of a real time poll- 
ing of the people that are actually controlling the launch. 

In those latter meetings we are not, I would say, formal- 
ly involved in those unless there is some problem with the 
hardware itself . . . We are polled by the Director of En- 
gineering prior to the launch actually proceeding, so we 
are sort of polled in an informal manner. We are not 
asked at any time after the L-minus-one-day for a formal 
go or no-go.!*5 


Contractors can stop the launch if they have serious reservations 
about the safety of the mission, and presumably they would. 


Mr. Davis... . I have never felt that if I needed to stop 
a launch, I could not stop it. While I have not been asked 
for a positive go or no-go, the ability is always there if I 
decide по, to stop the launch.!*$ 


145 Ihid., July 15, 1986, pp. 71-72. 
146 Tbid., p. 73. 


152 


However, the present system permits them to “express сопсегп” 
without actually saying, "stop the flight, it is unsafe’. If the odds 
favor a successful flight they do not have to be responsible for can- 
celling, yet if the mission fails they are on record as having warned 
about potential dangers. (see Section V, discussion over Rockwell 
concerns over ice) 


Issue 6 


Are astronauts adequately represented in the decision making 
process? 


Finding 
The astronauts believe they currently have the opportunity to 


make inputs into the process and are reluctant to assume a greater 
responsibility for the decision to launch. 


Discussion 


Considerable discussion at the hearing focused on the astronaut’s 
interest in being more involved in the decision making, for exam- 
ple by attending management meetings. Capt. Young made the 
point that astronauts really didn’t have the time to attend a lot of 
meetings, or the technical expertise to influence the decision. 


We could certainly put people in those kinds of meet- 
ings. I am not sure they have the technical expertise to 
really be able to say go or not 50.147 


With regard to the SRB seals, he pointed out that he and Cap- 
tain Crippen had attended a briefing at Thiokol where it was 
stated that the seals weren’t even necessary, and some people were 
complaining about having to put two seals in. And he suggested 
that if others in the agency had understood the problem they 
would have stopped the flights. 


The rest of the agency, if they had been aware of this 
problem, we wouldn’t have flown. We would have fixed it. 
If other people responsible in the management structure 
had the feeling this was a serious problem, we wouldn’t 
have gone. We have to believe that, because there, on the 
Orbiter, there are 1500 criticality 1 items on the Orbiter 
alone, on STS-1, those items are still there, and if the 
management system can’t make sure those things are 
ready to fly, we can never fly again. 

If you have an astronaut saying every step of the way, 
don’t fly because of this, that or this, where they have no 
expertise, it would be troublesome. 148 


Mr. Lujan asked whether NASA should consider a new class of 
astronauts with specific technical expertise who would fly occasion- 
ally. Capt. Young suggested that this was not a good use of an as- 
tronaut’s talents. 


You can get real good engineers to do the same thing, a 
heck of a lot cheaper, and make just as good inputs... . 


147 Thid., June 25, 1986, p. 42. 
148 Tbid., р. 44. 
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In the main, you like to keep astronauts around to fly 
spaceships because that is their talent, and that is what 
they want to do. . . .149 


General McDivitt concurred: 


There should be a caution about putting too much respon- 
sibility on astronauts, when they don't have the time to do 
it. Like the flight crew commander is very busy prior to 
flight and does not have time to spend a lot of his time in- 
volved in reviewing engineering decisions that have al- 
ready been made by very professional people. . . .159 


In response to suggestions that the astronauts might have 
stopped the launch of 51-L had they been aware of the problems 
with the seals, Capt. Young provided an excellent analogy to illus- 
а эн skepticism that they would have altered the decision to 
aunch: 


If an engine man comes up and says that engine is ready 
to fly and the turbine blades are a little cracked but we 
have run tests and we can show with a cracked turbine 
blade the engine pumps are not going to come apart and 
we have got to fly, would an astronaut say no, you are not 
going to fly until you change the turbines, for example?!5! 


There was complete agreement among the astronauts who testi- 
fied that the crew should be able to make inputs to the decision 
making process, but they all felt they now have this opportunity; 
they can and do attend FRRs and other meetings. However, there 
was a strong feeling among the astronauts that they had to rely on 
the expertise of the engineers and the technical competence of the 
managers and could not be expected to intervene in that process. 
They believed it was unrealistic to expect the crew to make the go 
or no-go decision; astronauts should not be expected to represent 
the principal concern for safety. 

Major Slayton made the point that astronauts in general were 
willing to take more risk than management, not less. 


One philosophical point that needs to be brought out 
here... is that the crew commanders and astronauts in 
general view things a little bit different than everybody 
else does to begin with and you have to recognize that and 
be a little bit cautious. 

In general a crew commander, if given a choice, is will- 
ing to take more risk than his management. That has been 
the case in the past and he is more likely to give you a ‘go’ 
and you need somebody at a higher level that is willing to, 
on his behalf, willing to take the bull by the horns and 
have the guts to say ‘no go’ on behalf of the сгеу/.152 


Col. Hartsfield concurred: 
149 Ibid., р. 49. 
150 Ibid,, р. 53. 
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І wanted to say that I feel that it is just like in our own 
government, the buck stops at the White House or the 
Congress perhaps, but somewhere, but certainly above the 
level of the rest of us. 

I think that the decison to go or “по go” rightfully be- 
longs with the upper management, and not, my personal 
opinion, not with the crew. The crew input should be felt 
very strong.!53 


c. Technical Expertise of Personnel 


Issue 


Does NASA have an adequate level of in-house technical exper- 
tise to manage the Shuttle Program properly? 
Findings 

1. During the last decade NASA has had significant decreases in 
manpower. A disproportionate reduction may have occurred in the 
safety, reliability and quality assurance staff at NASA headquar- 
ters and at the Marshall Space Flight Center. Additionally during 
the period preceding the Challenger accident, the Office of Space 
Flight also suffered a decline in staff. The decreases may have lim- 
ited the ability of those offices to perform their review functions. 

2. The information presented to NASA headquarters on August 
19, 1985 was sufficient to require immediate and concentrated ef- 
forts to remedy the joint design flaws. The fact that NASA did not 
take stronger action to solve this problem indicates that its top 
technical staff did not fully accept or understand the seriousness of 
the joint problem. 


Recommendations 


1. NASA should review the numbers and qualifications of key 
staff in technical and management positions and should consider 
additional training and recruitment of individuals to further the 
quality and safety of NASA’s missions. 

2. The Committee should maintain on-going oversight of this 
analysis and conduct an in-depth examination upon the conclusion 
of NASA’s review. 


Discussion 

In the wake of the Challenger accident, serious questions arose 
over whether NASA had sufficient technical capability to identify 
and solve problems like the SRB seal problem. It is argued that 
through reductions in staffing levels and departures to the private 
sector by experienced technical employees, NASA lacked in-house 
problem assessment capability. This is an issue that is not subject 
to ready answers, and an in-depth examination of NASA technical 
capacity was generally beyond the scope of the Committee’s hear- 
ing. 

— it is clear that over the last 15 years NASA has had 
significant staffing reductions and that a disproportionate number 
of these reductions may have occurred in the areas of quality as- 
surance and safety.15+ While NASA argues that its personnel 
levels for these functions “were adequate," 155 the Rogers Commis- 
sion found: 


153 Ibid., р. 55. 
154 Ibid., June 11, 1986, pp. 59-70. 
155 Ibid., р. 60; material supplied for the record. 
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Reductions in safety, reliablility and quality assurance 
work force at Marshall and NASA Headquarters have seri- 
ously limited capability in those vital functions. 158 


Reductions were not limited to the safety and quality assurance 
program. The former Associate Administrator for Space Flight, 
Jesse Moore, testified that his office also experienced a decline in 
the number of staff. As Mr. Moore observed, “we need to. . . get 
as much technical expertise into the Office of Space Flight as we 
possibly can" in order to "work on a plane with the real experts— 
the contractors, the engineers, the safety people at the contractors 
and at the NASA centers. . .” 157 

Similar views were voiced by former Shuttle program manager 
Robert Thompson: 


I think we have to look pretty deep in our organization 
to make sure we are keeping enough technical muscle in 
the organization to continually search for these pending 
problems that are somtines pretty subtle. Sometimes they 
just don't, as I say, announce themselves. So you have to 
be willing to expend the resources and keep that technical 
muscle in place and you have to put that technical muscle 
close to the heart of the issue so that they can perceive a 
problem if it is just beginning to occur.!58 


It does not necessarily follow however, that reductions in the 
numbers of technical personnel automatically limit the ability of 
headquarters to identify and correct emerging problems. The ad- 
verse impact flows from those reductions that cut into crucial 
areas. Accordingly, the Committee is pleased that Admiral Truly 
has undertaken an examination "throughout the agency and par- 
ticularly in. . . the Space Shuttle program" to make sure that “уе 
have not only the right numbers but the right kind of trained 
people. . . 159 It is hoped that this analysis will identify appropri- 
ate technical staffing levels and positions that must be maintained 
if the agency is to properly perform its function. 

NASA technical expertise is further reduced by the departure of 
highly skilled employees. During fiscal year 1985, approximately 
1500 employees left the agency, over one-half of these (784) were 
engineers, technicians and scientists.!9? If present trends continue, 


156 Rogers Commission Report, Volume 1, р. 161. 

157 Cmte Hgs, Transcript, July 24, 1986, pp. 80-81. 

158 Ibid., рр. 117-18. | 

159 Tbid., June 11, 1986, pp. 61-2. Former Shuttle Program Manager, Robert Thompson, indi- 
cated the need for this analysis, stating: ". . . and I think the matter of being sure you have the 
proper people selected and that those people are proper! indoctrinated and trained for their 
position and they clearly understand the responsibi ity and reporting channels of their positions, 
1 think those are all areas for improvement." —Cmte Hgs, Transcript, July 24, 1986, р. 121. 

160 Material submitted for the record in response to written questions from Chairman Roe 
(letter dated 9/18/86). That submission includes the following table: 

NASA LOSSES FISCAL YEAR 1981-86 


[In fiscal years] 


1981 1982 1983 1984 1985 1986 


Тойбарыңндадыандарыы aaa eee 1,983 1,556 1,176 1,530 1,494 1,169 
Non-AST® Engineers ............2....м442.1..47.1:ҮТ4 41-600. 32 26 13 19 9 5 
AST пкіпеетв.......... он 665 503 386 516 569 457 
Life а escis ecis iisen ава азе 6 6 0 3 2 4 
ТесЬпісіаня........ манна 261 207 161 156 204 180 


*Non-Aerospace Technologist. 
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NASA can expect to lose between 7500 and 9000 technical and sci- 
entific employees over the next ten years.!9! While 50 percent of 
these personnel losses are formally attributed to retirement, NASA 
officials "know. . .that many retires leave NASA for higher paying 
jobs in industry." 152 Additionally, 17 percent of the departing em- 
ployees acknowledge that they are leaving NASA for more finan- 
cially rewarding jobs.!5? 

NASA is concerned that the difficulty it will experience in re- 
placing these employees is essentially the same that led to the de- 
partures; the agency's "salary structure is not sufficiently flexible 
and competitive to attract the very best talent our nation has to 
offer." 164 Therefore, despite liberal hire authority for engineering 
positions, NASA is experiencing difficulty in recruiting entry-level 
engineers, largely due to salary. As noted by the Agency: 


Currently the Government pays GS-7 recent college 
graduates in all engineering disciplines a special salary 
rate of $23,170. This is the statutory maximum under the 
current special salary rate provisions. At the same time, 
our private sector competitors are offering these graduates 
an average salary of $27,000 to $29,000 depending on the 
engineering discipline. It would take approximately a 20 
percent increase for us to match our competitors. Howev- 
er, absent a legislative change, the most we could offer in 
the next year would be the percentage increase to the Gen- 
лэ: A (perhaps two or three percent in January 

A continuing infusion of recent college graduates is criti- 
cal to the continued success of NASA's mission and accom- 
plishing this has become increasingly difficult. Inadequate 
salaries are an equally significant problem at the execu- 
tive levels in the авепсу.! 95 


While outside witnesses did not fully concur as to the prevalence 
of departures for the private sector, all acknowledged the need to 
create incentives for quality people to enter and remain with the 
agency.!99 To this end, NASA Administrator Fletcher is examining 
means by which his organization can retain its highly skilled tech- 
nical employees through a “тпоге motivational type of organiza- 
tional structure" and premium pay scheduled.!9$?7 The Committee 
shares NASA's concern that it maintain a strong in-house techni- 
cal capability and support staff. 

In addition to the number of technical managers, it is also neces- 
sary to examine their technical performance. Insight into NASA 
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162 Tbid. 
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166 Cmte Hgs, Transcript, July 24, 1986, pp. 119-23. 
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headquarters’ technical ability to discern and react to emerging 
problems may be gained from an examination of the manner in 
which it addressed the growing concerns with the O-rings in the 
summer of 1985. Prior to that time the problems with the O-rings 
had been briefed at all levels of the agency and had been presented 
to headquarters on at least two occasions.!99 However, increasing 
problems with case-to-case erosion prompted headquarters to re- 
quest a complete briefing “to go over the situation in detail." 169 

The meeting was chaired by Mr. Moore's deputy for technical 
matters, L. Michael Weeks, and attended by a number of other 
headquarters personnel which Mr. Moore characterized as having 
"some knowledge about the 5ЕВ.”179 In testimony before the 
— Commission, Mr. Moore described the composition of the 
тее пр: 


Mr. Winterhalter, who was Shuttle Propulsion Division 
Acting Director at that time, Mr. Bill Hamby was the STS 
program integration Deputy Director, Mr. Paul Wetzel, 
who was the Solid Rocket Booster programs chief, Mr. 
Paul Herr, who was the Solid Rocket Motor program man- 
ager, and Mr. Henry Quong, who was the reliability, main- 
tainability and quality assurance director of the chief engi- 
neer’s office. 

Those were the group of people at NASA headquarters 
who attended the meeting. Mr. Mulloy of Marshall Space 
Flight Center, who was a Solid Rocket Booster program 
manager, attended and Mr. Bob Swinghammer of Marshall 
also attended, who is the material and processes laborato- 
ry director at Marshall. Thiokol had a total of six people 


168 See, e.g., testimony of L. Michaei Weeks, Cmte Hgs, Transcript, June 12, 1986, p. 130; 
Rogers Commission Report, Volume I, pp. 120-140. 

169 Rogers Commission Report, Volume У, p 1051, testimony of Jesse Moore. A somewhat dif- 
ferent version of the — of the August 19 briefing was presented by Allen McDonald, Thio- 
— 2 ої Solid Rocket Motor Project, in testimony before the Rogers Commission (Ibid., 
рр. 1-92): 

Mr. McDoNALD. The meeting that occurred on August 19 came about ав a result of this prob- 
lem with the nozzle eroding through, and that is what drove that meeting. Headquarters wanted 
to hear about that. We lost the primary seal and eroded some secondary. 

We all sat down together and got together with the engineering people and put together that 
presentation and collectively said, you know, we ought to address the whole seal issue, not just 
that failure, because we all felt that if that ever happened in the field joint we were in bad 
trouble because the nozzle has a much better secondary seal than the field joint does. 

* * ж ж 


Mr. SUTTER. At this meeting on August 19th at headquarters, that was called because of Thio- 
kol’s concern that the joint was really in trouble? 

Mr. McDoNALD. No, it was called—we had had another meeting scheduled at Washington 
headquarters at that time that had a problem with the mixer fire earlier in the year, and there 
was а review of that. 

I believe Mike Weeks either called Joe or I or one of us and said well, you’re here, you ought 
to come and address a couple of other issues that have happened recently that we are very in- 
terested in. 

One of them is we had broken the structural test article on the filament would case I believe 
in July down at Marshall, and they wanted to hear about that. 

The other one was they were made aware that we had violated the primary seal in the nozzle 
and wanted to hear about that and what our rationale was to continue. 

See also, Cmte Hgs, Transcript, June 17, 1986, pp. 98-101. 

170 Cmte Hgs, Transcript, July 24, 1986, p. 97. 
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there, including Mr. Mason, Mr. Wiggins, Mr. Kilminster, 
Mr. McDonald and Mr. 5реав.!?! 


The briefing documents prepared by Thiokol included a detailed 
history of seal erosion which noted, inter alia, that the “frequency 
of O-ring damage has increased since incorporation of Randolph 
putty; higher stabilization pressures in leak test procedures; and 
high performance motors.” The briefing documents also listed 
MTI's primary concerns; the highest concern was “Field joint— 
joint deflection and secondary O-ring resiliency." 

It is suggested that the August 19th briefing failed to give a com- 
plete picture of the seriousness of the O-ring problem because it did 
not include data on the effect that temperature would have on re- 
siliency of the seals. As Michael Weeks noted in his testimony 
before the Committee: 


When the briefing was presented to us on August 19th 
of 1985—as you will look in the briefing that was provided 
to the Commission on February 10th—there was no tem- 
perature data presented that showed that the resiliency 
was such a critical factor. It wasn't until after the disaster 
of 51-L that I actually saw the resiliency data that showed 
that Viton, which is the O-ring material that we've been 
using, is so slow to recover at very low temperatures—'!7? 


Mr. Weeks correctly notes that the briefing documents did not 
include data which resulted from bench testing which concluded 
that resiliency is a function of temperature.!"? 

Other participants in the meeting felt that the temperature issue 
had been presented at the briefing. 


General KUTYNA. Secondly, there has been some ques- 
tion that people understood that there was a temperature 
problem. I remember your conclusions chart, your file 
chart, and the very first bullet of that chart had the word 
"resiliency" in it. 

Do you feel when you talked about resiliency at that 
meeting people got the connection between resiliency and 
temperature, that resiliency was a function of tempera- 
ture, or was that lost? 

Mr. Мсроматр. It may have gotten lost because we 
hadn't run a very long range of temperatures when we got 
that data. 

General Котума. So it is possible that people at head- 
quarters from that briefing did not understand tempera- 
ture was a concern? 

Mr. McDONALD. I guess it is possible they could have. 

General Kutyna. Is it probable? 

Mr. McDONALD. I don’t know if it is probable, because 
we put it as the first bullet of why we thought that was 


171 Rogers Commission Report, Volume V, pp. 1051-52. 

112 Cmte Hgs, Transcript, June 12, 1986, p. 138. 

173 Letter from Brian Russell, Manager MTI SRM Ignition System to James W. Thomas, Маг- 
shall Space Flight Center, August 9, 1985. 
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our highest concern, and if that hadn't have happened, we 
wouldn't have had that concern.174 


The briefing recommended an “accelerated pace" to eliminate 
SRM seal erosion but concluded that “it is safe to continue flying 
existing design as long as all joints are leak checked with a 200 
psig stabilization pressure, are free of contamination in the seal 
areas and meet O-ring squeeze requirements." Sometime thereaf- 
ter, Mr. Weeks reported to Mr. Moore on the briefing, indicating 
that it was safe to continue the program and that it was not “ап 
issue that ought to ground the fleet."!75 

In evaluating the information presented at the August 19, 1985, 
briefing, the Rogers Commission found: 


The O-ring erosion history presented to Level I at NASA 
headquarters in August 1985 was sufficiently detailed to 
require corrective action prior to the next flight.17 


The current NASA administrator concurs in the finding.!77 

Despite the clarity of the Commission's conclusions, none of the 
participants at this meeting (all with technical backgrounds)— 
NASA or Thiokol—recommended that the Shuttle be grounded 
until the problem with the seals was solved.!78 Rather, as noted 
above, the unanimous recommendation was to accelerate the ef- 
forts to fix the problem but continue flying. In adopting this 
course, did NASA take steps to seek a solution that was reasonably 
commensurate with a threatened failure of a criticality 1 item? Mr. 


114 Rogers Commission Report, Volume V, pp. 1595-96. 

175 Ibid., р. 1052. See also, Cmte Hgs, Transcript, June 12, 1986, pp. 143-44, and July 24, 1986, 
р 90. А conflict in the testimony arose оп the question of the briefing Mr. Weeks provided Mr. 

oore following the August 19th meeting. According to the testimony presented by Mr. Weeks, 
“I briefed on the results of that [meeting] and told kim about the briefing and showed him the 
briefing [documents].” Ibid., June 12, 1986, p. 143. Mr. Moore disagreed with this recitation of 
the facts (Ibid., July 24, 1986, pp. 89-91): 

Mr. ScHEUER. Are you telling us that you didn't receive a briefing from Mr. Weeks and that 
you didn't receive the briefing documents from Mr. Weeks that was given to headquarters by 
the Thiokol officials? 

Mr. Моове. To my recollection, the first time 1 remember seeing that document was on 
August—was on January 29th or January 30th, right after the Challenger accident. I was shown 
a document which contained the briefing material. It also subsequently came up in one of the 
earlier discussions with Chairman Rogers and his Commission is the other time I have seen 
some of that. 

Post-accident was the first time I had, to my knowledge, as I said, seen that particular brief- 
ing. I had not sat down and been given a briefing on the Thiokol presentation on August 19th. 


ж * ж ж 

Mr. Weeks verbally said that the meeting was held that day on August 19th and that in effect 
that he felt comfortable with the overall conclusions, although he did have one more concern. 
He felt he wanted to talk to somebody else at Marshall and he did, I believe, talk to Mr. Hardy 
and said that he thought based on the data and also on the Titan success that in fact there was 
an acceptable position as far as he was concerned and that is where I left the information and 
that was the information I was given. 

Mr. ScHEUER. He didn’t indicate the kind of depth of concern that would have led you to be- 
lieve that additional time was needed or that additional resources needed to apply to some of 
these problems before lunch? 

Mr. Moore. No sir. 1 did not get the feeling that we should have grounded the Shuttle fleet 
prior to the next flight as a result of that particular briefing. 

In a subsequent interview with staff, Mr. Weeks recanted his earlier statement and acknowl- 
edged that he did not show Mr. Moore a copy of the briefing document and that to the best of 
his knowledge Mr. Moore did not see this document until after the Challenger accident. More- 
over, Mr. Weeks stated that he did not tell Moore specifically that Morton Thiokol was calling 
for an accelerated pace to eliminate the seal erosion problem nor did he state that additional 
resources were needed to be committed to solve the problem. 

116 Rogers Commission Report, Volume І, р. 148. 

177 Cmte Hgs, Transcript, June 12, 1986, p. 129. 

178 Трі4., June 17, 1986, pp. 97-8, 101. 
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Moore, when asked what he would have done had ће received the 
oral briefing and reviewed the briefing document responded: 


I believe that looking at the document and looking at 
some of the issues that were cited about criticality 1, flight 
safety issues and mission success issues that came out in 
the series of the document there, I believe we would have 
initiated a formal team to go off and take a much more 
concentrated look at it. 

So I believe my actions would have been to form a team 
of experts to asess this data and to make recommendations 
on what our course of action should be at this point in 
time.17? 


Unfortunately this team of experts was not formed until after 
the Challenger accident. Rather, NASA proceeded on the course 
summarized in the following exchange between Chairman Roe and 
Michael Weeks: 


Mr. Кок. Therefore, there are a group of people—whom- 
ever they were—that participated at this particular meet- 
ing, reviewed these facts that were available, and they de- 
termined two things, according to your testimony. One, 
they determined that if everything—if they had their 
"druthers," or whatever the case may be—it would take 
two years in their judgment to be able to correct that; but 
in spite of that decision they took and made the second 
judgement. Апа the second judgement, well, we can con- 
tinue to fly. We'll start the mechanisms going to get this 
corrected, but we can continue to fly until we get that 
done. Isn't that the decision that was made, according to 
what you're saying? 

Mr. WEEKS. That is correct. 

Mr. КОЕ. Therefore, some people who were at that spe- 
cific meeting had to be the people who made that specific 
decision.!89 


In attempting to assess the reasons for NASA Level 1 managers 
not adopting a more aggressive posture to the O-ring problem, it is 
suggested that insufficient information was communicated to 
{ор.181 However, as Deputy Acting Administrator Graham ob- 
served: 


They could have transmitted the information in a higher 
profile way, but also as engineers, as managers at head- 
quarters, there was certainly a responsibility to perceive 
the significance of this.! 5? 


There was plainly a failure of NASA technical managers, and for 
that matter those at Thiokol, to grasp the seriousness of the prob- 
lem. Ав former Shuttle Program Manager Robert Thompson ob- 
served: 


179 Ibid., July 24, 1986, pp. 91-2. 

180 Ibid., June 12, 1986, р. 141. 

181 The issue of whether communications are filtered so that important information is pre- 
vented from reaching decision-makers is addressed in Section VI.B.2.b. 

182 Cmte Hgs, Transcript, June 17, 1986, p. 207. 
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Sometimes these problems are very subtle. Sometimes 
they stand up and shout louder than at other times. 
Frankly, this time I think it was standing up and shouting 
pretty loudly.!$? 


Why then did top technical managers in the Office of Space 
Flight at NASA Headquarters (Level D, Johnson Space Flight 
Center (Level ID, and the Marshall Space Flight Center (Level Ш) 
fail to take stronger action? (See VI. А.І.) The answer may be 
simply poor technical decision-making, perhaps in combination 
with a type of collective rationalization described by Larry Mulloy: 


You asked why wasn't more done. You know, in the six 
years previous. And I have had that question posted to me 
many times in the last four months, and I have asked it of 
myself many times since the tragic accident. And my 
answer has been in hindsight, obviously, more should have 
been done. 

The turning, I think we started down a road where we 
had a design deficiency. When we recognized that it had 
design deficiency, we did not fix it. Then we continued to 
fly with it, and rationalized why it was safe, and eventual- 
ly concluded and convinced ourselves that it was an ac- 
ceptable risk. 

That was—when we started down that road, we started 
down the road to eventually having the inevitable acci- 
dent. I believe that.184 


d. Change Control Process 


Issue 1 


Has the pressure to maintain operational flight rates and sched- 
ules for the Shuttle compromised the hardware Change Control 
Process? 

Findings 

1. When NASA declared the Space Shuttle to be an operational 
system, additional pressure to increase flight rates impacted other 
aspects of the overall program such as the ability to implement, 
evaluate, test, and certify changes in hardware design. 

2. As a result of attempting to operate the Shuttle at increased 
flight rates, controlling other aspects of the program such as the 
flight production process and manifest also became a more complex 
and difficult aspect of program administration. 


Recommendations 


1. NASA must reconsider its efforts to categorize the Shuttle as 
an operational transportation system. 

2. The Configuration Management System designed to control 
such changes must be reexamined by NASA as to its effectiveness 
in assuring that all hardware changes take place in a safe and reli- 
able fashion. 


183 Ibid., July 24, 1986, р. 117. 
184 Thid., June 17, 1986, pp. 215-16. 
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Discussion 


The Rogers Commission noted that, “Following successful com- 
pletion of the orbital flight test phase of the Shuttle program, the 
system was declared to be operational.” 185 The Commission found 
that as a result, NASA reduced its safety, reliability and quality 
assurance activities related to the Shuttle. The Commission report 
goes on to note that this reasoning was faulty; “The machinery is 
highly complex, and the requirements are exacting. The Space 
Shuttle remains a totally new system with little or no history.” 

Program officials frequently find it necessary to consider chang- 
ing existing hardware designs or production processes. Such 
changes can be required for a number of reasons, including: to cor- 
rect the deficiency in a component; to improve a component’s per- 
formance or the length of this operating life; to enhance the ease of 
maintaining the component; or to reduce the cost of manufactur- 
ing, servicing, or processing the component. Typically, change pro- 
posals originate from a manufacturer and are reviewed by the cog- 
nizant NASA field center and frequently by the Level II Program 
Office at the Johnson Space Center as well. In his review process, 
NASA compares the cost and schedule impacts of the proposed 
change against the performance improvement that is anticipated. 
Of particular concern are the safety aspects related to the change 
(e.g., What analyses and tests must be conducted to insure that the 
change does not directly or indirectly have a negative impact on 
the systems safety or reliability?). 

It is clear that these activities or steps in the process of imple- 
menting essential changes are complex and time consuming, espe- 
cially if the components to be evaluated are some of the larger and 
critical elements of the Space Shuttle. Therefore, it is the Commit- 
tee’s view that until such time as all elements of the Space Trans- 
portation System can be fully evaluated through extensive flight 
testing and trend analyses, it is premature to impose an operation- 
al flight schedule on the system in a manner comparable to that 
imposed upon, for example, an air transportation system. 


Issue 2 


Is the change control process sufficiently defined for all elements 
of the Shuttle system? 
Findings 

1. The NSTS engineering and process change guidelines are, for 
the most part, sufficiently well-defined for the majority of the sub- 
systems that comprise the Space Shuttle. | | 

2. NASA gives the same level of scrutiny to changes involving a 


minor component (such as moving velcro strips in the Orbiter) as 
those involving mission critical elements of flight hardware. 


Recommendation 


NASA should review its change control process to determine the 
usefulness of differentiating between minor changes and significant 
changes. 


185 Rogers Commission Report, Volume 1, р. 159. 
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Discussion 


NASA’s Change Control System is shown in Figure VI-4. From 
the chart, it is evident that the success of the system is highly de- 
pendent on the information flow among the various levels of man- 
agement control. 
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The Configuration Management System Requirements аге docu- 
mented in JSC 07700 Volume 4, entitled “Configuration Manage- 
ment Requirements,” dated March 2, 1973. Changes to this docu- 
ment have periodically been issued over the course of the program. 
The configuration management system defines requirements for all 
levels of management within the NSTS program. A baseline set of 
requirements is defined for each level of management (Level I 
through Level IV). This baseline establishes what is to be accom- 
plished at each level of management and established the control- 
ling procedures that supposedly prevent deviations from the base- 
line program. This baseline program is specified for each flight and 
includes specifications on payloads for each flight as well. 

Changes to the flight and system requirements and the accept- 
ance baselines are made, according to NASA, only by directives 
issued by the Program Requirements Control Board at Level I and 
Level II and the Change Control Boards. For example, there is an 
Orbiter Avionics Software Control Board (OASCB) that has joint 
Level II and Level III authority for managing the program-wide re- 
quirements for Shuttle computer hardware and software systems 
as part of the Orbiter project. The Board also assures the correct 
configuration of the software within the Orbiter avionics system 
for all vehicle and test operations. 

Design changes at the contractor level are processed through sev- 
eral levels of technical and managerial reviews. Design and engi- 
neering changes on the Orbiter, for example, undergo Technical 
Status Reviews (TSR’s), Avionics Status Reviews (ASR’s), Prelimi- 
nary Design Reviews (PDR’s), Critical Design Reviews, (CDR’s), 
Design Certification Reviews (DCR’s), and numerous special meet- 
ings of NASA and the Rockwell management are utilized to review 
issues and concerns about any design drawing or specification. Ac- 
cording to Rockwell,!$9 “Changes are reviewed at a TSR ог ASR 
and the Change Control Board for approval. Any outstanding 
design dispute is tracked as an open action until it is resolved by 
Rockwell and NASA management.” 

The Committee questions, however, whether the complex and ex- 
tensive processes involved in NASA’s change control management 
system allow for sufficient distinction between minor changes and 
the significant changes. For example, the systems requires the 
same level of management attention to as minor a change as 
moving velcro strips on the Orbiter as it is applied to all Criticality 
1 item such as changing a turbo-pump on the SSME. 


2. ORGANIZATION AND POLICY MANAGEMENT 
a. Management Structure 


Issue 1 


Does the management of the Shuttle Program adequately define 
the lines of authority and are managers given authority commen- 
surate with their responsibilities? 


186 Responses to Committee Questions, dated August 22, 1986. 
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Finding 

The management of the Shuttle Program is complex and diversi- 
fied and it is not always clear who has authority or responsibility. 
NASA’s “lead center” concept has resulted in placing the manage- 
ment of the program at JSC, one of three centers participating in 
the program; however, because Johnson does not have control of 
the other centers’ resources, the NSTS program manager’s author- 
ity to manage the program is limited and the responsibility is un- 
clear. 


Recommendation 


NASA should restructure the Shuttle Program management to 
define clear lines of authority and responsibilities. This restructur- 
ing should take into account the special role each center must play 
and be especially sensitive to the need for the cooperation and sup- 
port of all the participants to achieve a common goal. NASA 
should give special consideration to moving the Program Manager 
to NASA Headquarters to avoid the confusion and inter-center ri- 
valry that result from having a large multi-center program man- 
aged out of one of the participating centers. 


Discussion 


The line of management responsibility, authority, and account- 
ability for NASA programs is from the Administrator to the Asso- 
ciate Administrator to the Field Center Directors, who delegate im- 
plementation authority to a program/project manager. JSC has 
been designated the “lead” center for the NSTS Program and has 
the responsibility for systems engineering and integration, oper- 
ations integration, and management integration. Marshall has the 
responsibility for the propulsion system and Kennedy has the re- 
sponsibility for launch operations. 

The Associate Administrator for Space Flight (the Level I pro- 
gram manager) performs oversight over the program but doesn't 
have the technical staff to effectively manage the program. The 
NSTS Program Manager, i.e. the Level II manager at JSC, func- 
tions as a program coordinator; he is responsible for integrating 
the various program elements and he controls all the project inter- 
faces. He clearly does not control all the program elements since 
the individual (Level III) Project Managers are accountable to their 
Center Directors who are in turn accountable to the Associate Ad- 
ministrator who controls the funding. For example, the Level II 
manager told the Rogers Commission that he was unaware that 
the SRB Project Office had procured additional Solid Rocket Motor 
casings to be used for testing of the joints; 

Now it turns out that the budget for that kind of work 
does not come through my level II office. It is worked di- 
rectly between the Marshall Center and NASA Headquar- 
ters and there again had I been responsible for the budget 
for that sort of work, it would have to come through 
me, ss ae 


187 Rogers Commission Report, Volume V, p. 1490. 
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The witnesses who addressed the management issues at the Com- 
mittee hearings had differing philosophies regarding the best possi- 
ble solution; however there was general agreement that the 
present system tended to cause confusion. There was also strong 
sentiment for strengthening the headquarter’s role. Mr. Jesse 
Moore, former Associate Administrator for Space Flight, testified: 


I think we need to go back and make sure we clearly 
define the roles of NASA headquarters, the roles of the 
centers in the overall management of the STS. 

I think we need to re-look at that kind of interaction 
and the kind of specific roles, responsibilities, to ensure 
that authority and responsibility is commensurate in 
terms of the role definitions for the varous levels of man- 
agement in NASA. 

I think we need to look at strengthening NASA head- 
quarters. I would say that in my tenure a NASA head- 
quarters we had a decline in staff in the Office of Space 
Flight. It was a decline in the number of staff, and I think 
we need to look at what is the proper level of staffing re- 
quirements to do this particular job. 

I also think we need to look to make sure we get as 
much technical expertise into the Office of Space Flight as 
we possibly сап.188 


General Stafford, a former Gemini and Apollo astronaut, also 
stated: “. . . I guess I was never comfortable with the lead center 
type of management structure, after having seen how satisfactorily 
Apollo worked.” 189 (Note: The Apollo program was managed out 
of headquarters.) 

With regard to the appropriate role of the Program Manager 
(Level П), there was not a clear consensus. In discussing the Rogers 
Commission’s recommendations, General Abrahamson stated: 


. . . However, I would also like to point out that many 
of these recommendations have long been incorporated in 
NASA management procedures. The Program Manager, by 
definition, has the necessary authority to get the job 
done.!9° 


When asked if the program management should remain at JSC, 
Mr. Moore, who is currently Director of JSC, replied: 


I think that is certainly a topic that is going to be stud- 
ied very, very carefully. 

I think there are a couple of options that can be looked 
at that would keep the major parts of program manage- 
ment that has been in operation at the Johnson Space 
Center at the Johnson Center. 

There are a lot of tools, roots and capabilities. I think, 
on the other hand, there should be some looks at the 
Office of Space Flight for finding some way to strengthen 


188 Cmte Hgs, Transcript, July 24, 1986, pp. 80, 87. 
189 Thid., June 25, 1986, р. 128. 
190 ТЬі4., July 24, 1986, p. 11. 
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— ешп program management in the Office of Space 
ight. 

And one concept might be to have a Shuttle Program Di- 
rector within the Office of Space Flight and working with 
the Level II program office at the Johnson Space Center. 

My answer is, I believe the Level II program office, with 
some strengthening, and the level I program office, with 
some strengthening—we can make it work and it should 
remain at the Johnson Space Center.!9! 


This was in direct contrast to the view held by John Yardley, 
former Associate Administrator for Space Flight. In discussing the 
Rogers Commission’s recommendations, he stated: 


The one in particular that I think I have some back- 
ground in that I think is not correct is they are trying to 
strengthen the authority and responsibility of the Program 
Manager at Johnson. Let me just relate what happened 
when I went to NASA. 

I hadn’t been there but a couple of weeks and one of the 
other centers called me and said, "Неу, the Program Man- 
ager wants to take 15 million of my money and put it on 
the Orbiter.” It became immediately apparent to me to 
have one of the center people handle the funding decisions 
was not going to be in the best interests of cooperative 
technical activity. 

So ГриПей the final decisions on the money to Washing- 
ton, where 1 think they still are. . .!?? 


Major Slayton made a similar observation concerning the prob- 
lems with having a multi-center program managed at one of the 
field centers: 


...lthink when you look at relationships between the 
centers and how the organization is structured; and you 
could say it could be restructured so you don't have inter- 
center jealousies interfering with the communications 
channel. 

A lead center concept where Level П is viewed by the 
other centers as being another center instead of having its 
headquarters' level is one reference I would make.!?? 


Major Slayton went on to say that any organization could work 
with the proper people: 
A lot of it is in the management attitude; but again, my 
opinion is, you can make any organization work if you got 
the right people, and if you don't have the right people I 
don't care how you organize it, it will not work, so you still 
end up dealing with individuals.!?* 


181 Ibid., р. 99. 

192 Thid., July 23, 1986, p. 10. 
193 Ibid., June 25, 1986, p. 101. 
194 Thid. 
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Other witnesses also alluded to the problems with inter-center ri- 
valries under the current system and the break down of esprit de 
corps. Mr. Moore called for a new effort to re-instill the team spirit: 


I believe an approach to that has got to be building team 
work, again, to make sure—the Shuttle program involves 
many elements, many contractors, many NASA centers, 
all playing together as a team. 

I believe we have to go back and re-instill in our people, 
in our participants, a team work approach... 

I think the overall structure of the Shuttle program is 
obviously built upon people and, you know, there are 
humans all the way up the chain, all the way from the en- 
gineers at the subcontractors to the engineers at the con- 
tractors, the NASA centers and so forth. 

I think we have got to make sure that each of those par- 
ticipants in the program feel a dedication, feel a dedication 
to safety, feel a dedication to the program that they are 
making a valuable contribution and I think we need to do 
that by personal communications as well as trying to look 
at our structure to make sure we have not defined some- 
thing that will at least maybe encourage, tend to encour- 
age communications breakdown.!?5 


General Abrahamson made the following observations with 
regard to changing organization: 


It is true that when any organization is formed, it is 
formed to help you accomplish a particular task. By the 
same token, once it is there, it develops momentum and 
procedures and impediments sometimes to exactly what 
you would like to have, a dynamic and modifying organiza- 
tion for the challenges of the future. This is always diffi- 
cult. 

I believe that we had an organization that was designed 
for the development of the Shuttle, and when we got there, 
since it was only the second flight, that we had a tremen- 
dous change of attitude that we had to be able to create, 
and that was to create an organization that would think in 
terms of operations of the Shuttle and overcome the flight 
test ргор!ешв. 196 


Іззие 2 
Are astronauts adequately represented in management? 
Finding 
The Committee finds no evidence that astronauts are denied the 
opportunity to enter management if they so choose. 
Discussion 


The Rogers Commission has suggested that NASA should make 
greater use of astronauts in management; however, the Commis- 


195 Ibid., July 24, 1986, рр. 69-70. 
196 Thid., р. 17. 
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sion report provides по basis for that recommendation. Astronauts 
generally have shown little interest in going into any kind of desk 
job, including management positions, until such time as their 
active flying days end. At that time, management jobs within the 
astronaut program become attractive alternatives to some; howev- 
er, opportunities in this area are naturally limited. Major Slayton 
expressed this very well when he testified about his experience 
with the Mercury Program: 


I had the misfortune at that time of having been ground- 
ed due to a medical problem so I was elected to take over 
the management of the astronaut corps, a job I didn’t par- 
ticularly care about, but it was the next best thing.!?? 


Mr. Nelson asked the astronauts whether any of them felt there 
was a “modus operandi” within NASA that excluded either active 
or former astronauts from the management structure. General 
McDivitt stated he had seen no bias in his three years as Program 
manager for the Apollo Program. Mr. Nelson then asked Deke 
Slayton if he had ever seen any bias in NASA and Major Slayton 
confirmed that he too saw no evidence of bias against astronauts in 
management. General Abrahamson observed: 


Throughout my tenure, astronauts were in key program 
office positions and one served as an Assistant Associate 
Administrator in the Office of Space Flight. . . .198 


There was agreement among the astronauts that the astronaut 
office should be moved up higher in the organization. General 
McDivitt summed up the astronauts’ position: 


I think I would recommend that the Flight Crew Oper- 
ations Directorate be moved up to report to the Center Di- 
rector as well as the Flight Operations Director. 

I think both of those organizations are very key to 
flying, and having them go through another layer of man- 
agement before they get to the Center Director creates a 
filter which is not necessary or desirable for either one of 
them. 

I think it also gets them on the same level as the engi- 
neering organizations within the manned spacecraft 
center, and gives them better access to the рговтат.19 


b. Communication 


Issue 1 


Are there adequate opportunities to communicate problems 
within the Shuttle Program management structure? 


Finding 
There are many regularly scheduled meetings and teleconfer- 


ences at all levels of management throughout the Shuttle Program. 
In addition, "special" meetings and telecons are routine. No evi- 


197 Thid., June 25, 1986, р. 11. 
198 [bid., July 24, 1986, p. 11. 
199 Ibid., June 25, 1986, р. 52. 
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dence was found to support а conclusion that the system inhibited 
communication or that it was difficult to surface problems. 


Discussion 


Every day at noon central time a teleconference is held among 
all NASA Space Shuttle Program participants. This is the daily 
“special” Level II PRCB (Program Requirements Change Board) 
meeting and includes, among others, all the managers of the vari- 
ous program elements, the JSC Directors of Flight Crew Oper- 
ations, Mission Operations, Engineering, Mission Support, SR&QA, 
and Space and Life Sciences. Program status, urgent problems, and 
program requirements are brought up at this meeting. The PRCB 
convenes by teleconference on alternate Fridays to discuss all other 
(less urgent) program issues; in addition, other special meetings are 
called by the PRCB secretary when deemed necessary. 

Each of the supporting organizations also has regularly sched- 
uled meetings, often by teleconference when they involve more 
than one location. Regularly scheduled (often daily) teleconferences 
are also held between various directors and managers. 

Level I at headquarters conducts daily status meetings and also 
participates in the noon teleconference. These meetings plus all the 
Flight Readiness Reviews provide ample opportunity to surface 
problems. 


Issue 2 


Is too much information being disseminated so that important in- 
formation is lost? 


Finding 
Large amounts of information are disseminated on a routine 


basis, often with little or no indication of its importance to all of 
the recipients. 


Recommendation 

NASA management should review the process of providing infor- 
mation on significant actions so that awareness by concerned man- 
agers is assured. 


Discussion 

In a NASA briefing to staff on Mission Operations (May 21, 
1986), NASA managers revealed that they routinely received infor- 
mation copies of all sorts of memoranda, such as directives, re- 
quests, approvals for changes, etc. Often the individual receiving 
these copies had no direct involvement with the specific subject of 
the memoranda, and they acknowledged that it was entirely likely 
that an important piece of information could cross their desk with- 
out their awareness. 


Issue 3 


Are communications filtered so that important information is 
prevented from reaching the decision makers? 
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Finding 

NASA managers delegated the responsibility for making techni- 
cal judgments to lower level managers or assistants. Therefore, the 
information that reached the top decision makers was “filtered” in 
that it was interpreted by others that were presumed to have more 
specialized experience or expertise in a given area. There is no evi- 
dence that middle leve] managers suppressed information that they 
themselves deemed to be significant. In fact, as discussed in the 
Section on Technical Expertise, the failure was not the problem of 
technical communications, but rather a failure of technical deci- 
sionmaking. 


Discussion 


It is typical in any large, complex organization that as managers 
rise higher in the organization the scope of their responsibilities 
broadens to encompass technical areas beyond their own special- 
ized expertise. Therefore they must rely increasingly on the techni- 
cal judgments of lower level managers or assistants. There is the 
additional risk of subordinates’ reluctance to transmit unpleasant 
information upwards; however, it is not evident that NASA manag- 
ers — information about problems they themselves under- 
stood. 

Throughout the hearings, witnesses said that had they known 
about the seriousness of the problem with the SRM joint, they 
would have stopped the flights; or (in their opinion), had the deci- 
sion makers known about it the flights would have stopped. The 
witnesses acknowledged that the problems with the SRM joint had 
been briefed at all levels, but always in a way that didn’t communi- 
cate the seriousness of the problem; it was not viewed as life- 
threatening. Yet the witnesses appeared reluctant to attribute this 
to poor technical judgments on the part of the managers or techni- 
са) staff with expertise in propulsion, preferring instead to blame it 
on poor communications or a poor “decision-making process.” 

Mr. Scheuer questioned Jesse Moore specifically on this point 
when he asked, referring to Mr. Weeks’ summary of the August 19 
meeting, “Was it a failure of decision-making on his part or com- 
munications on his part?” Mr. Moore responded: 


Sir, I think that in a position like Mr. Weeks is in, we 
have to work as a team, for example, and people have to 
make assessments on situations and I think Mr. Weeks 
looked at the data and his assessment was that he thought 
we had a program adequate to cover the activities in the 
SRB and he believed that after he had talked to the people 
at Thiokol and he also believed that, I think, after talking 
to the people at Marshall and I believe his position was 
that in fact was an acceptable posture for him to take. 
Part of his responsibility is to make technical judg- 
ments.?9° 


Mr. Moore went on to explain that he believed the lack of under- 
standing of the SRB joint extended throughout the agency: 


200 Ibid., July 24, 1986, р. 94. 
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I would say, sir, in looking up and down the system апа 
what has been determined about the SRB from the man 
analyses and work that has been done in the past, I don’t 
think the system all the way from day one of the program 
really understood all the implications of how the SRB 
joints worked and I think that we have learned, all of us 
have learned, an awful lot about the SRB . . .201 


And again referring to the August 19 meeting: 


That was a report from my deputy (Mr. Weeks), that he 
believed the situation was acceptable as far as assessment 
of the data presented to him, and I trust the people in the 
organization to make those kinds of judgments. 

We have to make those judgments on a day-to-day kind 
of basis, but I did hear at Flight Readiness Reviews, as ev- 
erybody as a member of the overall Shuttle team heard 
about issues associated with the O-ring problem. I believe 
the first time this was experienced on the Shuttle Program 
was all the way back to flight 2 . . . I did not, as the head 
of the Level I office, believe the problem with the SRB O- 
rings was serious enough to consider stopping the 
launches. 

If I did, I would have stopped the launches, sir.?°? 


Mr. Scheuer again asked Mr. Moore to identify where the failure 
was, “Was it in your being communicated with by Mr. Weeks? Was 
it a failure of judgment on Mr. Weeks' part that all systems were 
go? Where was the failure?" At that point, Mr. Moore blamed the 
failure on communications: 


] think in looking at the whole situation, I think there 
was a failure to communicate the technical seriousness 
from the contractors involved їп this program 


through . . . .293 


But, Mr. Scheuer suggested that the contractors had communi- 
cated the problem at the August 19th meeting. Mr. Moore then 
suggested that perhaps someone should have made a stronger 
statement; however, in their collective judgment it was not a seri- 
ous problem: 


On the basis of the specific August 19 briefing that was 
presented, I believe there should have been a stronger 
statement made to me that we have a much more serious 
problem by Mr. Weeks or any of the people who attended 
that briefing. Mr. Weeks was not the only one at the brief- 
ing. There were others at the briefing who had some 
knowledge about the SRB .... 

I don't recall the specific list of attendees at that par- 
ticular meeting, but people that were in the overall pro- 
pulsion area of the office of space flight—and the office of 
space flight is level one—that is the level one—people who 
had experience in this thing. 


201 Ibid., p. 95. 
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I believe if they felt after that August 19th briefing that 
we had a problem, that the system should be grounded, 
that somebody would have come and said, “We have got a 
problem serious enough to ground the Shuttle flight.” 

That did not occur, and I believe it was based on a col- 
lective set of judgments that we did not believe the prob- 
lem was as serious.?94 


The Committee finds no reason to doubt Mr. Moore's observa- 
tions that no one within NASA understood the problem with the O- 
ring and accepts his conclusions: 


In hindsight, I think we should have taken much strong- 
er action after the August 19th briefing . . . if I had the 
knowledge then that I have today, we would have ground- 
ed the fleet. 

I did not have it at the time.?95 


In hindsight, the August 19th briefing, as well as the January 
27th telephone conversation clearly identified a serious problem. 
Perhaps the Thiokol engineers understood the seriousness of the 
problem; however, Thiokol's own summary and recommendation at 
the conclusion of the August 19th briefing stated: 


Analysis of existing data indicates that it is safe to con- 
tinue flying existing design as long as all joints are leak 
checked with a 200 psig stabilization pressure, are free of 
contamination in the seal areas and meet O-ring squeeze 
requirements.?96 


This conclusion was accepted by all who heard the briefing, and 
this was the information that was transmitted throughout NASA. 
The evidence does not support a conclusion that the top decision 
makers would have arrived at a different conclusion from the man- 
agers at Marshall and the Level I managers with propulsion back- 
grounds. (For additional discussion on this issue, see Section 
УТ.В.1.с.) 


с. Safety, Reliability and Quality Assurance 


Issue 1 

Is NASA’s decision to establish a new Office of Safety, Reliabil- 
ity, and Quality Assurance appropriate and, if so, what should its 
role be? 
Finding 

The Committee finds that the Rogers Commission recommenda- 
tion that NASA should establish an Office of Safety, Reliability 
and Quality Assurance that reports directly to the Administrator is 
indeed appropriate. However it is not clear what the activities of 
this office will encompass. 


204 Ibid, р. 98. 
208 тым. 
206 Rogers Commission Report., Volume II, р. Н-95. 
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Recommendations 


1. The Associate Administrator for Safety, Reliability and Qual- 
ity Assurance (SR&QA) should provide to the Committee the agen- 
cy's draft plan delineating the organization, goals, implementation 
strategies and resource requirements of the office of SR&QA. 

2. After the Office of SR&QA is fully operational, the Committee 
will wish to continue oversight over its activities. 


Discussion 


Chapter 7 of the Rogers Commission report deals with the sub- 
ject entitled "The Silent Safety Program." The Commission identi- 
fied shortcomings in NASA's overall Safety, Reliability and Quality 
Assurance Programs, and recommended the formation of a sepa- 
rate Office of Safety, Reliability and Quality Assurance that would 
report directly to the Administrator. The role of safety and quality 
assurance in the decisionmaking processes associated with Shuttle 
flight production requirements has been relatively undefined and 
ambiguous. The formation of a centralized coordination and contro] 
organization should serve to remedy the situation. As the Rogers 
Commission report notes, ". . . No one thought to invite a safety 
representative or a reliability and quality assurance engineer to 
ine January 21, 1986 teleconference between Marshall and Thio- 
ko * 207 

On July 8, 1986, the Administrator established the position of As- 
sociate Administrator for Safety, Reliability and Quality Assur- 
ance, and briefly delineated the responsibilities of this office in 
NASA's responsive document to the Rogers Commission герогі.208 

According to NASA, the purpose of this office is to strengthen 
the role of the SR&QA functions across all the the NASA pro- 
grams. This will be accomplished by establishing centralized coordi- 
nation under the Associate Administrator for SR&QA who reports 
directly to the Administrator on all pertinent matters related to 
the NSTS. The Associate Administrator is chartered to examine 
the adequacy of the agencies resources in these areas and to make 
recommendations for improvements as appropriate. Functional or- 
ganizations that were previously under the purview of the Chief 
Engineer’s office will now report directly to the Associate Adminis- 
trator for SR&QA. 

The major contractors to the NSTS agree with the Commission’s 
recommendation to form a separate NASA SR&QA organization re- 
porting directly to the Administrator. They are, however, of the 
opinion that responsibility for the work required to recommend or 
implement changes or modifications in the quality assurance area 
must remain with Level III and the contractors themselves. 

The Committee does not argue with the contention that strong 
SR&QA capabilities must reside at the contractors’ plants. Further, 
the Committee suports NASA’s efforts to enhance its in-house ca- 
pabilities in order to improve the agency’s monitoring and over- 
sight capabilities in the areas of SR&QA. Strengthening Headquar- 
ter’s ability to provide guidance and centralized coordination in the 


207 Ibid., Volume I, р. 152. 
208 NASA Response to Rogers Commission, July 14, 1986, p. 20. 
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areas of configuration management, product reliability апа quality 
assurance and risk management, are essential to returnng the 
Shuttle to flight readiness condition. 


Issue 2 


Has NASA applied sufficient resources to support adequate 
SR&QA efforts within the NSTS program? 

Findings 

1. The Committee finds that reductions in NASA civil service 
personnel that have occurred over the past decade have adversely 
impacted the agency’s ability to maintain the appropriate level of 
oversight control of the Safety, Reliability and Quality Assurance 
activities within the NSTS. 

2. NASA has become increasingly dependent upon outside 
SR&QA support from the Department of Defense (Defense Contract 
Administration Services [DCAS] and Air Force Plant Representa- 
tive Office [AFPRO]) and contractors. 

3. NASA has reduced or reassigned to other program areas in- 
house safety, reliability and quality assurance tasks such as test- 
ing, analyses and instrumentation and has reduced or shut down 
in-house facilities for performing SR&QA research and technology 
development. The degree to which these factors have adversely im- 
pacted the safety, reliability and quality assurance activities within 
the NSTS program has not been adequately assessed. 


Recommendations 


1. NASA should establish and maintain a strong and effective 
SR&QA Program. Continuing support for such a program must 
come directly from the Administrator. | 

2. Although it is appropriate to establish strong contractor capa- 
bilitie in the areas of SR&QA the internal oversight responsibilities 
and coordination of SR&QA tasks must be the responsibility of 
NASA itself. In order to assure that the appropriate interfaces 
among the various subsystem elements that comprise the NSTS, 
are maintained, a sufficient complement of NASA SR&QA manage- 
ment and support staff must be available to perform the necessary 
oversight and coordination tasks. 

Discussion 

Reductions in force over the past several years have reduced per- 
sonnel across the agency from a complement of some thirty-six 
thousand people down to twenty-two thousand people. A dispropor- 
tionate decline in Reliability and Quality Assurance (R&QA) staff- 
ing occured as a result of these reductions. In the Shuttle program, 
many of the quality control functions and government inspection 
activities have been performed by contractors in conjunction with 
the Department of Defense support personnel (DCAS and AFPRO). 
NASA has expressed some concern about their ability to maintain 
adequate in-house staffing in these areas. The total number of civil 
servant employees within NASA dedicated to the SR&QA program 
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is presently about 500 professionals.2°® This represents a reduction 
of 71% from the 1970 complement. 


NASA attributes this reduction to the termination of “in-house 
flight programs, along with the transfer of certain functions . . . to 
other organizations within the NASA centers.” In their response to 
Mr. Roe's inquiry,?!? NASA makes the following statement: 


“Even though we had a reduction in R&QA personnel, 
our detailed review of the quality operation did not reveal 
that we missed any of the quality control check points 
which may be contributed to the accident.” 


The Committee cannot support NASA's assessment on this 
matter. Although NASA may argue that the quality control check 
points for the certification tests required on the ambient and in- 
duced temperature effects on the O-ring seals were checked off by 
the QA representative at Thiokol as having been satisfactorily com- 
pleted, in actuality these tests were never performed. To what 
extent this failure of the QA function to do its job conbributed to 
the accident may be questioned, but the fact that the control didn't 
work in this case cannot be denied. 

It should be noted, however, that according to some of the prime 
contractors, SR&QA staffing has actually improved over the 
years.?!! For example, at the Rocketdyne Corporation, there has 
been an increase in QA staffing to a level that represents nearly 
40% of the corporation's manufacturing staff. 


Issue 3 


Are the responsibilities of safety engineers and design engineers 
adequately specified within NASA's "risk management" program? 


Finding 

The roles of safety, design as well as reliability engineers are not 
adequately and uniformly defined throughout the NSTS program. 
In some cases, the Committee learned that safety engineers were 
not participating in major decisions related to flights of the Shut- 
tle. 


Recommendations 


It should be the responsibility of the new Associate Administra- 
tor for SR&QA to fully specify the roles of safety and reliability en- 
gineering as well as quality assurance personnel within the NSTS 
program so that all critical aspects of the program and decisions 
related to the adequacy of hardware and subsystem performance 
are fully reviewed by these disciplines. 


Discussion 


The function of the safety engineers within the NSTS program 
has been to determine whether or not certain prescribed tests, 
analyses, and design descriptions have been followed appropriately 


209 Discussion with the NASA Chief Engineer's Office, May 13, 1986. Also, Cmte Hgs, re- 
sponse to question by Mr. Roe, Transcript, June 11, 1986, pp. 59-60. 

210 Cmte Hgs, response to question by Mr. Roe, Transcript, June 11, 1986, pp. 59-60. 

211 Telephone Conversation, August 13, 1986. 
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as they relate to safety concerns, using the techniques ої HA. The 
safety office has not been significantly involved in the engineering 
design efforts. If an engineering problem arises that could effect 
the safety of the overall system, it is the responsibility of design 
engineering teams to perform technical evaluations rather than 
having these analyses performed by the safety engineers. Prior to 
the Challenger accident, the safety program did not have the per- 
sonnel, facilities or expertise to review decisions by design engi- 
neers that the O-ring erosion problem was a manageable risk. Even 
though this erosion was a continuing problem, there was, according 
to testimony provided to the Rogers Commission, no second set of 
“eyes” available to question waiver applied to this problem.?!? 


Issue 4 


Does the SR&QA program require improved coordination be- 
tween centers, contractors and NASA Headquarters? 


Findings 


1. Although guidelines have been published that describe the re- 
sponsibility of contractors in the areas of SR&QA,?!? NASA's 
guidelines do not adequately distinguish these various activities as 
distinct disciplines requiring specialized skills and centralized co- 
ordination. | 

2. In its review of the agency's reliability and quality assurance 
programs as they relate to the Space Shuttle, the Committee found 
there was little commonality among the cognizant officials at 
MSFC, JSC, KSC, and Headquarters in the perception of the vari- 
2. responsibilities associated with these separate and distinct dis- 
ciplines. 


Recommendations 


1. It is important that a clear delineation of responsibilities for 
the separate SR&QA disciplines be appropriately documented. It is 
also essential that the relative importance of each of the three sep- 
arate disciplines be established as an integral part of the NSTS 
program. These functions are the responsibility of NASA Head- 
quarters. 

2. NASA must carefully review the staff and resources devoted 
to the SR&QA function within NASA and contractor organizations 
for adequacy. The Administrator shall report to the Committee 
with his findings and recommendations. 


Discussion 


Although the controlling document describing the SR&QA func- 
tions for the Shuttle contractors was provided to the Committee, no 
corresponding document was identified that describes the imple- 
mentation of these functions for the SR&QA engineers that are 
direct employees of NASA. NASA contends that the same control- 
ling document applies to agency employees. The specific oversight 


212 Testimony before the Rogers Commission, Mr. Jack Walker, Deputy Director, MSFC 
Safety Office, April, 1986. 

213 NASA, “Safety, Reliability, Maintainability and Quality Provisions for the Space Shuttle 
Program”: NHB 5300.4 (1D-2), October, 1979 
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responsibilities of these employees and their independent reviews 
and analyses requires a more complete delineation in the Commit- 
tee’s view. The Rogers Commission report provides definitions for 
the SR&QA disciplines.?!* An expansion upon these definitions is 
required in order to establish a commonality of understanding of 
the various functions as they apply to the Shuttle program. 

The management structure within NASA that coordinates and 
performs the activities associated with the SR&QA tasks for the 
NSTS has become decentralized over the past decade. Until recent- 
ly many of the oversight duties that at one time were handled 
through Level І were moved to the field centers. Responsibilities 
for various systems that comprise the Space Shuttle are delegated 
to the Level III field centers. These centers establish and coordi- 
nate SR&QA activities at the contractor facilities. They are also re- 
sponsible for reporting any anomalies, inconsistencies, or problems 
to Level II program management. 

Until recently, the Office of the Chief Engineer had responsibil- 
ity for SR&QA activities. For various reasons, the operations of this 
office in the areas of SR&QA appear to have lost effectiveness, 
either through reductions of personnel and support of these pro- 
grams at the Headquarters level or through the diffusion of these 
functions into various organizations within the operating divisions 
at the field centers.?!5 These changes reduced Headquarter’s abili- 
ty to participate in field center status reviews with the prime con- 
tractors, limited the Level I manager’s ability to survey the effec- 
tiveness of the SR&QA programs agency-wide and reduced the co- 
location of SR&QA personnel within Headquarter’s program of- 
fices. The Committee expects that the new Office of SR&QA will be 
chartered to make appropriate corrections to augment the safety, 
reliability and quality assurance functions within the NSTS Pro- 
gram. 


d. Contractor Incentives 


Issue 


Key Shuttle contracts (e.g., the Solid Rocket Booster Production 
Contract and the Shuttle Processing Contract (SPC)) provide incen- 
tives both for reliability, integrity, and safety of products and serv- 
ices on the one hand, and for cost and schedule on the other. Do 
these contracts provide an appropriate balance between the two 
types of incentives? That is, does NASA utilize contracts to reward 
and promote operational safety? 


Findings 

1. The SPC provides far greater incentives to the contractor for 
minimizing costs and meeting schedules than for features related 
to safety and performance. SPC is a cost-plus, incentive/award fee 
contract. The amount of the incentive fee is based on contract costs 
(lower costs yields a larger incentive fee) and on safe and successful 
launch and recovery of the Orbiter. The award fee is designed to 
permit NASA to focus on those areas of concern which are not sen- 


214 Rogers Commission Report, Volume І, р. 152. 
215 Discussion with the NASA Chief Engineer’s Office, May 13, 1986. 
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sitive to the incentive fee provisions, including the safety record of 
the contractor. However, the incentive fee dwarfs the award fee— 
while the maximum value of the award fee is only one percent of 
the value of the SPC, the incentive fee could total as much as 14 
percent of the SPC. 

2. During the developmental phases of the Thiokol contract for 
Solid Rocket Booster production (1980-1983), the contractor re- 
ceived consistent ratings of "Excellent-Plus" or "Superior" under 
the cost-plus, award-fee contract. NASA contracted with Thiokol on 
a cost-plus, incentive-fee (CPIF) basis beginning in July, 1983. The 
CPIF contract pays strictly on the basis of costs, although penalties 
may be invoked for delays in delivery or for Shuttle accidents due 
to SRB failure. At the time of the Challenger accident, Thiokol was 
eligible to receive a very large incentive fee, probably on the order 
of $75 million. 


Recommendations 


1. NASA should reexamine all Shuttle contracts and report to 
the Committee with its findings and recommendations on whether 
more incentives for safety and quality can be built into these con- 
tracts. This report should address, inter alio, the SRB Production 
Contract and the SPC. 

2. NASA's new Office of SR&QA should be involved in the pro- 
curement and award fee processes, both to establish reasonable 
guidelines and rewards in new contract and to judge performance 
of ongoing contracts. 


Discussion 

Mr. Robert Thompson, Vice President of McDonnell Douglas, 
summarized the position of several Committee witnesses when he 
stated: 


I have never detected that a contractor would deliberate- 
ly infringe on safety for a profit motive.?!5 


On the other hand, Thompson also admitted that contracís do 
vary in the extent of their safety incentives and that, to a certain 
degree, such incentives can make a difference in operational safety: 


. .. the type of safety that we are looking for, for a 
system like the Shuttle, І think they can be enhanced with 
these kind of stipulations in a contract. They can't truly be 
bought that way. 

Certainly you [could] hang a larger incentive toward 
safety. You may enhance a strong focus on safety and I 
would not say that it wouldn't do some good to enlarge 
those enhancements.?!? 


The more difficult question is whether existing NASA contracts, 
such as the SPC and the SRB Production Contact, strike an appro- 
priate balance between safety incentives and cost/schedule incen- 
tives. This question is particularly critical in light of reductions in 


216 Cmte Hgs, Transcript, July 24, 1986, p. 135. 
217 Ibid. 
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NASA’s SR & QA programs detailed іп Section VI.B.2.c. of this 
report. 

Both Thiokol and NASA witnesses on June 17, 1986, argued that 
the penalties inherent in the Thiokol contract with Marshall Space 
Flight Center provided more than adequate incentives for Thiokol 
to deliver safe, reliable products. These penalties are of two types. 
Late-delivery penalties amount to $100-200 thousand per unit. Pen- 
alties for mission failures are much larger: 


If findings of this Board of Investigation determines (sic) 
that the cause of the failure is attributed to the Solid 
Rocket Motor/Motors not performing in compliance with 
the specification requirements of the contract, a fee reduc- 
tion of $10,000,000 for each category I failure and 
$5,000,000 for each category II failure shall be deducted 
from any fee otherwise earned under this сопігасі.218 


Similarly, in briefings for Committee staff, NASA contract man- 
agers have stated that the award fee portion of the SPC, though 
small, is highly visible and that contractors take the award fee and 
the semiannual contract ratings very seriously. In NASA’s view, 
high ratings enhance a company’s reputation and, therefore, its 
likelihood of competing effectively for additional contracts. 

Nevertheless, there are several reasons to believe that NASA 
could utilize contractual terms more effectively to enhance pro- 
gram safety. First, there can be no argument, for both the SPC and 
the SRB contract, that absent a major mission failure, virtually all 
the financial incentives are tilted toward cost-savings and timely 
delivery. 

Secondly, because of the complex and overlapping division of re- 
sponsibilities between NASA and its contractors, it is not clear that 
contractors will be fully penalized even in cases where their actions 
or their hardware appear to be directly responsible for a mission 
failure. Mr. Scheuer’s questioning of Mr. Charles Locke, Chairman 
of the Board of Morton Thiokol, showed that Thiokol is not pre- 
pared to accept the full contractual penalties for the Challenger ac- 
cident.?19 

Finally, it is revealing that, under its NASA contract, Thiokol 
was never penalized for any of the numerous SRB flight anoma- 
lies.22° The booster joint had never worked as intended, nor was its 
behavior at ignition ever clearly understood. Occurrences of O-ring 
erosion and/or blow-by exceeded twenty-five at the time of the 
Challenger accident. In fact, the rate of erosion/blow-by had in- 
creased steadily since the beginning of the SRB contract in 1983. 
The seal problem was serious enough to lead both to briefings at 
Headquarters and to establishment of a re-design task force. Yet, 
in spite of all these problems, Thiokol was eligible to receive a 
near-maximum incentive fee of approximately $75 million. But, in 
the final analysis, it was NASA that both approved the SRB design 


218 NASA, Schedule D, NAS8-30490, April 12, 1983, p. 71. 

219 Cmte Hgs, Transcript, June 17, 1986, pp. 55-56. 

220 While this discussion focuses on possible contract penalties related to flight anomalies, it 
is also interesting to note that Thiokol has never been penalized for numerous safety and proc- 
ess violations at its Utah facilities. Several of these violations have resulted in serious fires and/ 
or explosions. 
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and drew up an SRB contract which contained no provisions for 
performance penalties or flight-anomaly penalties. One must not 
fault Thiokol for collecting the bonus; one must fault NASA for al- 
lowing the bonus to be collected at all. 

The problem with the kinds of penalties that were contained in 
the SRB contract is that, so long as management is convinced that 
a festering problem like the seal problem is not likely to cause mis- 
sion failure, there is little incentive for the company to spend re- 
sources to fix the problem. In fact, if the solution involves signifi- 
cant delays in delivery, there may be a strong financial dis-incen- 
tive for the company to pursue a short-term solution aggressively. 
For example, Thiokol engineer R.M. Boisjoly provided a clear warn- 
ing of the seriousness of the O-ring problem in July, 1985, and 
Thiokol engineer A. R. Thompson laid out a plan for a possible 
short-term solution to the problem.??! Whatever its efficacy, why 
was Thompson’s plan apparently dismissed so summarily? Part of 
the answer may be found in the June 18, 1986, exchange between 
Mr. Scheuer and Mr. Thompson: 


Mr. ScHEvER. Would the research and development of 
your fixes have delayed the delivery of ths SRMs to 
NASA? 


Mr. THOMPSON. . . . It probably would have delayed it a 
month or two, at least for the hardware and some of the 
research work. . . .222 


The Committee is certainly not suggesting that anyone іп NASA 
or Thiokol would recommend launch or would refuse to spend re- 
sources fixing a problem if it was known that the problem consti- 
tuted a real threat to mission safety. However, in the case of the 
SRB joint, both NASA and Thiokol managers clearly misjudged the 
threat to mission safety. In situations of this sort, contractual pro- 
visions rewarding performance rather than cost and schedule 
would have provided a far stronger incentive to fix a long-festering 
problem. Ultimately, the balance between safety incentives and 
cost/schedule incentives in the SRB contract may illuminate a 
number of issues raised by the Challenger accident. 


221 Rogers Commission Report, Volume I, pp. 249-51. 
222 Cmte Hgs, Transcript, June 18, 1986, р. 18. 


УП. CASING JOINT DESIGN 


Discussion 
(a) Introduction 


The fact that the aft field joint of the right-hand Solid Rocket 
Booster failed at the 300 degree location is overwhelmingly sup- 
ported by the evidence. Retrieval of two large pieces of the joint 
clearly show that they were destroyed by the heat and velocity of 
the gas flame emanating from the right-hand booster. Additional 
supporting evidence was found by reviewing the telemetry data 
and the photographs taken during launch and flight.! 

For the purpose of redesigning the joint it is important that the 
way in which the joint failed be determined as closely as possible. 
This determination, however, is difficult, if not impossible, to make 
with one hundred percent certainty. The evidence to support 
progress of the failure through the joint is incomplete. However, 
based on the recorded history of the joint problems encountered in 
flight and in test, based on the laws of physics, and based on behav- 
ior of the materials used in the joint, the following PROBABLE 
CAUSE is offered. 


(Ь) Probable Cause of Failure 


1. Both the primary O-ring and the secondary O-ring were seated 
when the steel casings were mated. The pressure check verified 
this fact. However, from experience, the primary O-ring was seated 
in the upstream position as had been previously recognized by 
NASA and Thiokol engineers. (See Figure VII-1.) 


1 Rogers Commission Report, Volume I, pp. 22-23 and 78-79. 
(183) 
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2. Upon ignition, the primary O-ring could пої reseat at the 800 
degree location in the downstream position, where it needed to be 
in time to prevent blowby. At this point there were too many defi- 
ciencies acting in unison which prevented the O-ring from reseat- 
ing in that location. First, proper spacing between the inner face of 
the tang and the opposing face of the inner leg of the clevis ap- 
proximately 0.020 inches, is critical. That spacing for Flight 51-L 
was too small, at the 300 degree location where the smoke was ob- 
served, to facilitate prompt reseating of the primary O-ring. Calcu- 
lations of segment diameters indicate the gap spacing was only 
0.004 inches, near metal-to-metal contact. The ignition gases passed 
the O-ring at this location (See Figure УП-2). This condition did 
not exist elsewhere in the joint around the casings since the pri- 
mary O-ring was able to seat around the joint in other locations. 

Second, the low temperature throughout the night prior to 
launch left the fluorocarbon elastomer primary O-ring stiff and 
lacking in ability to spring into the downstream (seated) position at 
the 300 degree location in time, relative to the buildup of motor 
pressure, to provide a tight seal. The temperature of the aft field 
joint at time of launch was calculated by Thiokol after the accident 
to be 16 degree F. Part of the reason for this low temperature was 
the heat transfer away from the joint, by conduction through the 
aft attachment strut. The conduction was driven by liquid hydro- 
gen, which remained in the external tank overnight. The supercold 
fuel created a 430 degree temperature differential across the ship, 
drawing heat out of the joint and O-rings. 

At ignition, blowby occurred, either with erosion of the primary 
O-ring or without erosion. 
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8. However, there could have been опе or more than опе blow- 
hole through the zinc chromate putty before ignition. One such 
blowhole could have been made at the 300 degree location either 
during the leak check at 200 psi prior to the seating of the primary 
O-ring or prior to the leak check when the casings were brought 
together. If so, there was a high probability that the primary O- 
ring eroded at this point. The phenomena of blowing holes in the 
putty had been observed many times at post-flight dismantlement 
and had dramatically increased when the procedures were changed 
to increase the test pressure to 200 psi. Additionally, the Randolph 
putty had been found unsatisfactory on numerous occasions. 

4. Upon ignition of the Solid Rocket Motor, this blowhole would 
have facilitated and concentrated the hot propellant gas flame on 
the primary O-ring, and possibly the secondary O-ring as well. 
Alignment of O-ring erosion with the location of blowholes had 
been observed on numerous occasions.? 

5. Between the time the casings were assembled and the launch, 
the secondary O-ring was unseated from its previously sealed posi- 
tion. The fact that it had been sealed has been verified by the pres- 
sure check made 28 days before when the casings were joined. 
Either the secondary O-ring was unseated by joint rotation coupled 
with O-ring stiffness or by the formation of ice in the joint. 

During the intervening period, as the Shuttle stood on Pad 39B 
waiting for the launch, 7 inches of rain had fallen and some could 
have easily penetrated the joints. The access of rain water into the 
joints was proved when STS-9 was disassembled and water poured 
out of the assembly pin holes. In tests conducted after the accident, 
it was confirmed that the water in the aft field joint would have 
turned to ice, and that the ice could have dislodged the secondary 
O-ring, pushing it upstream into a non-sealed position. In this posi- 
tion, it 15 doubtful that the secondary O-ring could have sealed at 
ignition. 

6. One of the three Solid Rocket Booster to External Tank aft at- 
tachment struts is also connected at the 300 degree location, just a 
few inches below the aft field joint. As the Space Shuttle system 
stood on the launch platform at Pad B on January 28, the large 
External Tank was gradually filled with liquid hydrogen and liquid 
oxygen. Liquid hydrogen, at a temperature of 428 deg F below zero, 
and liquid oxygen, at a temperature of 297 deg F below zero, 
caused the tank to contract as it was filled. Since the Solid Rocket 
Boosters are firmly bolted to the launch platform, a lateral force of 
approximately 190,000 pounds pulled sideways on the aft attach- 
ment strut and the Solid Rocket Motor casing, including the joint 
that failed.* Refueling of the tank was accomplished early on the 
morning of January 28. 

At ignition, the 190,000-pound force was instantly released when 
the SRB hold-down bolts were blown loose. For the next two and a 
half seconds the right Solid Rocket Motor field joints experienced a 
3 cycle per second vibratory load caused by the sudden release of 


? NASA, MSFC Memo, Miller to Horton, April 12, 1984. 

3 Thiokol, “Erosion of SRM Pressure Seals," TWR 15160, Chart А-9, August 19, 1985: “Seal 
damage always has associated putty blowhole." 

* NASA, MSFC, “51-І, Analysis Overview," April 25, 1986, p. Н-208. 
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the lateral force.5 The ignition pressure increased the joint spacing. 
Also, the flow of motor gases through the blowhole at the 300 
degree location could have resulted in damage to the primary O- 
ring. The evidence of smoke at the 300 degree location is unlikely 
without O-ring damage. 

7. Smoke at launch, clearly visible in the photographs, stopped 
at 2.7 seconds when the vibratory load damped out and the joint 
sealed. The sealing of the breach at the 300 degree location was 
made possible by blockage from burned material, probably consist- 
ing of a mixture of insulation and aluminum oxide. Post-accident 
tests performed by Morton Thiokol proved that aluminum oxide 
could have successfully plugged the joint at 2.7 seconds. While the 
smoke at ignition appeared to be intermittent, that appearance was 
probably a result of air and main engine exhaust currents. 

8. At Т--87 seconds into the flight, the Shuttle encountered wind 
gust loads in conjunction with planned maneuvers. Components of 
these gust and maneuvering loads were transmitted to the Solid 
Rocket Booster through the External Tank attachment strut. Based 
on the prescence of smoke at liftoff, these forces were transmitted 
to a joint already weakened by erosion and heat damage. 

9. At 43 seconds into the flight, the main engines throttled back 
as the Shuttle reached “Max а” (maximum dynamic pressure). 
Four seconds later, the main engines had throttled up to 104% 
power and the geometry of the Solid Rocket Motor propellants had 
increased thrust. At this point, the motor pressure increased to 609 


psi. 

Additional structural loads resulted from turbulence. Flight 51-L 
experienced the most severe turbulence of any Shuttle flight and, 
although the loads were within the allowable design limits, those 
design limits did not consider a joint that had already failed.® It is 
unknown how much the combined effect of wind gust loads, ma- 
neuvering loads and an increase in thrust contributed to the acci- 
dent. But the combined effects of these forces could have dislodged 
the burned material at the previously breached section of the joint. 

10. Shortly after the vehicle was loaded by these turbulent 
forces, at T+58 seconds, a flame appeared from the same general 
region where the puffs of smoke had been seen. But, this time the 
joint was continuously breached by the burning propellant gases. 
In a little over two seconds, the flame had grown and acted as a 
blowtorch to burn through the hydrogen tank. The appearance of 
the flame at this time is also indicative of a damaged primary O- 
ring and failure of the secondary O-ring to seal, for reasons ex- 
plained in the Critical Items List dated December 17, 1982. 

The telemetry data, photographs and cockpit voice recordings 
support evidence of turbulent conditions and the manner in which 
the Shuttle failed. 


5 The joint was designed to accommodate these loads. 
* NASA, MSFC, “51-1, Analysis Overview, STS 51-L—Wind Shears, April 25, 1986, р. H-597. 
ба NASA, “SRB Critical Items List," December 17, 1982, page A-6A, sheet 1. 
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Time (min:sec) Crew position 7 Crew comment 
TEI а ни прав натерани ње ВІ аа Looks like we've got a lotta wind here today. 
БАУ c UR cca аи Yeah. 
ТЭ АНА РЕК ТКТ ТИП ТТ (ГК Loi С я It's а little hard to see out my window here. 
J НИНИН There’s ten thousand feet and Mach point five. 
14:40 мы ы IPOD (байхе) 
РАДО ава ады Сы атасында ыны ПО: аи Point nine. 
ЦЕСНА ТТС ы [High thrust vector control (steering) activity 


noted. This was caused by upper atmoshpere 
wind gusts and planned maneuvers. | 


ЕГЕН ata tpe Meade PETS найыбы tete There's Mach one. 

TERT u.a p ed ae нава CDR ыы ыра Going through nineteen thousand. 

FERS SS Sa mesmo: COR гневи OK, we're throttling down. 

EOL SSSR SAS ASD EUR. riae acte Throttling up. 

И И ИИ И ЛБ Рени Throttle ир. 

оно аиа еа ИА [Vehicle loaded by dynamic pressures.] 

TE ТИЕК пића низини па лит = Мита на [А flame appeared from same general region 
where the puffs of smoke had been seen 
earlier. | 

TEI СОН аны ы Roger. 

Т О ые РРО PET siste М/000000000. 

IEEE [Right SRM internal pressure began to diverge 
from that of left SRM] 

TVA су oe m ынаан аа ана. Сыл ле EAE гийн [Well-defined plume was deflected indicating the 


plume had burned through the liquid hydro- 
gen tank structure.) 


ТУРБА ——————————— в PET rs ага, Thirty-five thousand going through one point 
five. 

ТВ co ooo stc қада, ipeo аны [Liquid hydrogen leak noted.] 

[EI БЕКЕТКЕ ГА E СОК nens Reading four eighty six on mine. 

[f m ———"———"'— —HÓ [Leak confirmed when hydrogem tank leak 


pressurization system was unable to maintain 
normal pressurization гаїв.) 


TED] tie e ЛОС РАС Үер, that's what I've got, too. 
Е iss КО ЛК СОГУУ А к аа Roger, ро at throttle up. 
ТА ымы SRR ро: ана оа оа {Right Solid Rocket Booster motion differed 


from Orbiter and left Solid Rocket Booster, 
indicating failure of lower attachment struc- 


ture.] 
ТАЮ AA ав rores e И [Liquid hydrogen tank pressure fell. Leak was 
growing rapidly.] 
J... {Liquid hydrogen and liquid oxygen pressure to 
main engines showed significant drop.] 
ToS e E SSS ВІ наь Uh Oh 
ТЕРЛӘЛ Мем ee ыы ОРЕ НИНЕН СИТ [Circumferential white pattern around the Exter- 


nal Tank aft bulkhead suggested liquid hydro- 
gen tank structure failure. | 

(ЕЛ P КЕКЕ [Vapor observed at inter-tank which was indica- 
tive of the liquid oxygen tank failing. Liquid 
oxygen then observed.]® 


т (CDR) Commander Scobee, (PLT) Pilot Smith, (MS 1) Mission Specialist Onizuka, (MS 2) Mission Specialist Resnik. 
8 NASA, D.M. Germany, STS 511 Incident Investigation, Integrated Events Time Line, Johnson Space Flight Center, June 4, 1986, as modified. 


(c) Problems Discovered 


The design of the joint was based on the successful design of the 
joints used on the Titan III booster rocket.? That design was simi- 
lar except that the tang pointed upward, instead of down, and the 
clevis pointed downward, instead of up, as in the case of the Shut- 
tle booster. Another difference was that the design of the Shuttle 
joint included two O-rings instead of one as provided for in the 


9 NASA, “SRB Critical Items List," December 17, 1982, p. A-6A, Sheet 1. 
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Titan design. But, the most important difference was the use of 
putty in the Shuttle design. While the Titan employed the NBR in- 
sulation to close the gap between segments, the Shuttle design 
called for filling a gap between insulation with putty. 

The Shuttle design was changed to accommodate manufacturing 
constraints.!? The Shuttle booster is larger, 146 inches in diameter 
as compared to 120 inches for the Titan. As a result of its larger 
size, the Shuttle booster uses more steel. While this requirement 
for more steel had no impact on other booster components, it did 
have an impact on the joint design. The maximum billet size (a 
piece of metal made from an ingot) commercially available to man- 
ufacture the large, one-piece, weld free forward dome with an inte- 
gral forward skirt tang was less than that needed for the Shuttle 
Solid Rocket Boosters. However, it was found that by turning the 
casings upside down, there would be just enough metal to manufac- 
ture a forward dome because that component would then only have 
to incorporate the single joint element, the tang, instead of the 
double joint element, the clevis. 

It is good engineering practice to design products to accommo- 
date manufacturing tooling capabilities and methods. Furthermore, 
with the clevis facing up and the tang down, field assembly at the 
Kennedy Space Center was simplified. Combined with the extra O- 
ring, the design change appeared reasonable. But it is also good en- 
gineering practice to accommodate all the forces and conditions 
that the product must perform under during its useful life. The 
design of the Shuttle Solid Rocket Motor, as opposed to the Titan, 
had to provide for reuse of the propellant casings, including the 
wearing of joint surfaces and distortion of the case in handling and 
shipment. It had to accommodate heavier propellant loads. The 
design was more susceptible to water entry during storms. Апа, 
most significant, the design had to accommodate a combination of 
dynamic structural loads significantly different than those encoun- 
tered by the Titan. 

It is always a simple task to find fault with someone else's work; 
especially after an accident occurs. It is quite another matter to 
originate the work and produce a useful product. 

The joint design provided a direct path between the combustion 
chamber, consisting of an annulus with propellant surrounding it, 
and the outside of the steel motor casings. That path was sealed 
with putty and two circular fluorocarbon elastomer (rubber-like) 
bands called O-rings. While O-rings are frequently used to retain 
pressures much higher than those present in the Shuttle Solid 
Rocket Motor, thermal and structural forces acting on the Shuttle 
joints are formidable. These joints must carry and transfer these 
loads between the casings. 

Another essential ingredient of good engineering practice is to 
use material suited to the function. Some O-rings can withstand 
high temperatures. But “all . . . elastomers become brittle at low 
[temperatures] . . . Elastomers, like natural rubber, nitrile 
rubber, and Viton А... that become brittle at low [temperature] 


10 Staff discussion with E.G. Dorsey, Thiokol Wasatch Operations, Brigham City, Utah, Sep- 
tember 4, 1986. 
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сап be used for static seal gaskets when highly compressed at room 
temperature prior to cooling.” 11 

But the Shuttle’s O-rings were not used in a “static” system as 
evidenced by the variations in gap spacing between the tang and 
clevis. Nor would they always be highly compressed at room tem- 
perature prior бо the cooling. Furthermore, the O-rings could not 
withstand burning propellant temperatures in the range of 5800° F. 
The design of the joint therefore provided for putty to insulate the 
O-rings from the burning gases. 

This putty did not always perform as had been expected, and evi- 
dence of hot gas passing the putty and getting to the first, or pri- 
mary, O-ring along the path to the outside of the rocket chamber 
was discovered. Once the putty was breached, the joint was not 
working as it had been designed. This failure, although recognized 
by NASA and its contractor Morton Thiokol, was neglected on 
March 8, 1984 when they chose to accept an “allowable degree of 
erosion,’ which meant there was an allowable percentage of fail- 
ure.!? 

O-rings become effective (are seated) when pressure is applied to 
them as they sit in a groove provided to house them. 

One question that the design was intended to answer was wheth- 
er or not the O-ring was seated properly in its groove. Ап opening, 
with a fitting much like a valve stem on a tire, was provided to 
allow pressure testing between two such O-rings, the primary and 
the secondary. 

But this design did not always answer the question: was the pri- 
mary O-ring seated? Did it seal or not? Notice how the primary O- 
ring in Figure VII-1 (p. 176) is forced upward (shown by the single 
arrow). That is opposite to the normal direction that the propellant 
pressure acts (notice the double arrows). Even with an acceptable 
pressure check result, the primary O-ring would still be unseated 
for a fraction of a second when the motor pressure pushed the O- 
ring in the opposite direction from that which took place during 
the leak check. 

Тће second reason the assumption concerning the leak check as 
“proof of sealing" could be erroneous was that the primary O-ring 
did not really have to seat at all if the putty behind it (toward the 
inside of the case) held the pressure during the leak check. So ear- 
lier in the program there really was no way to know whether the 
primary O-ring seated or not. 

What appeared to be a rather straightforward joint was far from 
simple. If the primary O-ring did not seat during the leak check, 
and the pressure test succeeded, then the putty was doing the work 
of sealing. But it still was not possible to determine from outside 
the casings whether the putty or the O-ring was holding the pres- 
sure. But, if the leak check failed, then the O-ring was not seated 
and there was a blow-hole through the putty. 

To resolve this concern, NASA and its contractor, Morton Thio- 
kol, changed the leak-check procedure by increasing the pressure 
until a pressure of 200 pounds per square inch (psi) was accepted as 


11 Theodore Baumeister, Editor, Standard Handbook for Mechanical Engineers, ith Ed., (New 
York: McGraw-Hill, 1967), рр. 18-85. · 
1? Rogers Commission Report, Volume II, p. H-1. 
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the standard. They had ascertained that this was sufficient pres- 
sure to blow a hole through the putty.!? Then, if the O-ring failed 
to seat, the pressure would blow a hole through the putty and the 
test would disclose an unseated O-ring (a failed seal). But if the O- 
ring held the higher pressure, the O-ring would still have been 
seated in the upper position instead of the downward position. That 
would be contrary to the way the O-ring would have to be seated to 
contain the propellant pressure during launch of the Shuttle. 

In summary, there was still no way to verify whether the pri- 
mary O-ring was seated properly, meaning in the downstream posi- 
tion after the cases were joined together in the field. In the begin- 
ning of the development program the concept was that the putty 
would act somewhat like a “piston in a cylinder’ when the propel- 
lant was ignited. As the chamber pressure built up, the putty was 
to move downstream and compress the air in the path between it 
and the primary O-ring. The compressed gas was to seat the O-ring 
and thereby seal the joint. Besides, even if the primary O-ring 
didn’t seal, surely the secondary O-ring would, since it had already 
been pressure checked, which verified it was seated in the down- 
stream position. 

There was no direct evidence that the primary O-ring was not 
holding the pressure off the secondary ring until Flight 51-B. That 
was the first flight when erosion of the secondary O-ring had been 
observed, even though erosion of the primary O-ring had occurred 
before.!* 

Thiokol had considered the joint design to be Criticality 1R,15 
meaning that there was redundancy. While the second O-ring was 
redundant by design, the joint as a whole was still Criticality 1, 
since if it failed, it would mean the loss of the Shuttle and crew. In 
other words, there was no backup for the joint. 

The joint was designed to mate two rocket motor segment cases, 
one to the other, where the lower edge of the upper case consisted 
of a tang and the upper edge of the lower case consisted of a clevis. 
After the tang was inserted into the clevis (which housed the two 
O-rings), 177 steel pins, each approximately 1 inch in diameter, 
were inserted from the outside through aligned holes which went 
through the outer leg of the clevis, the tang and partly into the 
inner leg of the clevis. The spacing between the inner face of the 
tang and the mating face of the inner leg of the clevis where the O- 
rings were housed was critical to the integrity of the joint because 
that spacing, in part, determined whether the O-rings could func- 
tion properly to seal against the propellant gas pressures. Not only 
was the initial static spacing critical, but maintaining the proper 
spacing during launch and flight under dynamic structural load- 
ings was necessary for an effective seal. 

Upon ignition of the Solid Rocket Motor fuel the operating pres- 
sure increases to 922 psi at 40 degrees F within a little over one- 
half second (0.648 sec).1 The effect of this pressure increase is to 


13 NASA, MSFC, Problem Assessment System Record No. A07934, January 23, 1986, р. 6. 
1* Rogers Commission Report, Volume V, p. 1510. 

1$ Cmte Hgs, Transcript, June 18, 1986, р 51. 

16 Morton Thiokol, -10212 (CD), Table 4-9, Typical Propellant Design Data. 
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cause the casings to bulge out around their midsections while being 
constrained by the thicker steel sections at the ends, much like a 
can of soda after freezing. The casings change shape during the 
buildup of motor pressure. This bulging has an effect on the joint. 
As in the case of the frozen soda can, the wall of the casing near 
the joint is no longer vertical, or perpendicular to the bottom, but 
angles out to meet the larger diameter in the center of the casing. 
NASA calls this change in angle at the joint “joint rotation.”’ 

This joint rotation is a component of an overall spacing problem 
that includes: changes caused by casing wear and tear experienced 
during refurbishment; case growth (swelling) from pressurizing the 
casings; distortion that occurs during shipment of the loaded cas- 
ings; and the physical handling of the casings during stacking oper- 
ations. 

The joint rotation problem was aggravated when the steel cas- 
ings were made thinner to achieve a reduction in weight and thus 
an increase in payload. The rotation problem was further aggravat- 
ed by changing the design of the propellant geometry to achieve 
greater thrust. This increased the pressure within the casings and 
thereby increased the “gap opening."!? These changes compro- 
mised the integrity of the joint seals because joint rotation in- 
creases the spacing (gap) between the tang and the O-ring grooves 
in the clevis. 

When the increase in the gap occurs, it can open the O-ring seal, 
leaving the path from the propellant combustion chamber open to 
the outside of the casing, except for any blockage by the putty. But, 
as noted above, the putty frequently has holes blown through it. If 
there were blowholes in the putty, and the original spacing be- 
tween the metal parts of the joint was such that the joint rotation 
left open spaces between the O-rings and the tang, then the joint 
would fail and burning gases would escape to the outside. 


(d) Joint Behavior 


In a memo from John Miller to Mr. Eudy of NASA on June 16, 
1980, the following statement was made: 


STA-1 test data shows that the secondary O-ring can 
become unseated from the tang due to joint rotation at ap- 
proximately 40 percent of MEOP [Mean Effective Operat- 
ing Pressure], and therefore, is not likely to assume a seal- 
ing position should the above primary seal failure occur. 
The SRM has never been tested to evaluate the above fail- 
ure condition, nor has credibility of such a failure been of- 
ficially declared.!8 


In March of 1984 Thiokol had completed its SRM O-ring assem- 
bly test plan, which was to confirm the O-ring erosion scenario, 
provide data for heat transfer predictions and establish the effec- 


17 The Light Weight Casings, first used on STS-6, had thinner casing walls than the standard 
Steel casings. Light wahi casings permitted Might with heavier payloads: On STS-8, NASA 
began using the High Performance Motor (HPM) which developed higher internal pressures 
while using the light weight casings. The purpose of the HPM was to further increase payload 
capacity. 

iB АЗА, “Evaluation of TWR-12690 CD, Test Plan for Space Shuttle SRM — і Cyl- 
inder Segment Joint Verification, dated June 10, 1980", EP 25 (80-70), June 16, 1980, p. 2. 
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tiveness ої the vacuum putty. The introduction to that plan includ- 
ed the statement: 


O-ring seals in rocket motors in general and the Space 
Shuttle SRMs in particular, can suffer thermal degrada- 
tion because of exposure to the high temperature motor 
chamber gases. Although none of the SRM primary O- 
rings to date have failed to perform their design function, 
there is some concern because of isolated events which 
show localized erosion as high as 0.053 inches. The postu- 
lated scenario for this thermal degradation effect is a 
short-time duration impingement of a high energy jet 
which is induced during ignition pressurization by a com- 
bination of voids in the protective vacuum putty and the 
filling of available free volumes created by the tolerances 
of mating parts and the O-ring slots. Unfortunately, the 
overall assembly and the vacuum putty layup does not 
lend itself to a well-defined geometry for predicting the hot 
gas flow and associated heat transfer to the O-rings.!? 


A subsequent report, dated May 7, 1984, contained a statement: 


Symptom of failure: a vaccum putty exhibited gas paths 
located at 319 deg., 888 deg., and 347 deg. Erosion of the 
primary O-ring occurred at 319 deg. only. The damaged 
region was approximately 5.6 inches long with a .034 inch 
maximum depth and involved 136 deg. of the O-ring cross 
section diameter.?9 


In a memo from Larry Mulloy to Bob Lindstrom, Director, MSFC 
Shuttle Projects Office, in November of 1984 it was noted: 


. it was determined that shims could be used to make 
the case joint sufficiently concentric to consistantly 
achieve a 7.54 percent minimum O-ring squeeze. Therefore 
the 7.54 percent has been established as the minimum ac- 
ceptable requirement for both case and nozzle O-ring joints 
and verified by subscale testing and full scale experi- 
ence.?! 


On a 0.280 inch diameter O-ring a 7.54 percent squeeze would be 
equal to a compression distance of 0.021 inches.?? 

On July 17, 1985, Irv Davids, Manager of the Solid Rocket Boost- 
er Program at NASA Headquarters, sent a memo to the Associate 
Administrator for Space Flight, the subject of which was case-to- 


19 Thiokol, Philip Shadlesky, "Performance Characteristics of the SRM O-ring Assembly Test 
Plan", TWR-14336, dated March 1984, p. 1. 

20 Thiokol, S. Rodgers, "Significant Problem Report DR4-5/35: 5 Day Report; O-ring Erosion 
at Nozzle/Aft Segment Joint of SRM ПА (STS 41-B/Mission 41-С)”, -14810-1, May 7, 
1984, рр. 1-2. | . 

21 O-ring squeeze is the distance, in fractions of an inch, that an O-ring is compressed from its 
normally round shape. This dimension can also be expressed as a percentage of the total diame- 
ter before compression. In 1984 NASA was using a term "minimum — squeeze.” During an 
SRM design analysis of the case and nozzle O-ring joints it was concluded that the 146 inch 
diameter case cylinders would not meet the design standard of 15 percent minimum O-ring 
squeeze at zero pressure. The various problems that prevented this included flaws in the O-ring 
grooves and sealing surfaces and differences in the spacing between tang and clevis on various 
casings. 

22 NASA, Larry Mulloy, “ECP SRM 1197, Nozzle Nose Inlet Housing O-ring Squeeze,” SA 42- 
562-84, November 20, 1984, p. 1. 
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case and nozzle-to-case O-ring seal erosion problems.?3 Davids sent 
copies to Messrs. Weeks, Hamby, Herrington and Winterhalter.234 
In the memo it was noted that there has been twelve instances of 
primary O-ring erosion during Shuttle flights. In addition, in one 
specific case there had also been erosion of the secondary O-ring 
seal. There were also two primary O-ring seals that were heat af- 
fected without erosion and two cases in which soot blewby the pri- 
mary seals. In this memo it was noted that the prime suspect for 
the cause of erosion on the primary O-ring seals was the type of 
putty being used. It was Thiokol’s position that during assembly 
leak check, or ignition, a hole could be formed through the putty 
which then initiated O-ring erosion due to a “jetting effect.” It was 
even mentioned in this memo that Thiokol was seriously consider- 
ing the deletion of putty on the QM-5 nozzle/case joint since they 
believed the putty was the prime cause of the erosion. Davids, how- 
ever, had reservations about deleting the putty because he recog- 
nized the significance of the QM-5 firing in qualifying the FWC 
(Filament Wound Case) for flight. 

In the matter of case-to-case O-ring erosion the memo noted that 
there had been five occurrences during flight where there was pri- 
mary field joint O-ring erosion. There was also one case where the 
— O-ring was heat damaged with no erosion. The memo 
stated: 


The erosion with the field joint primary O-ring is consid- 
ered by some to be more critical than the nozzle joint due 
to the fact that during the pressure build up on the pri- 
mary O-ring the unpressurized field joint secondary seal 
unseats due to joint rotation.?* 


The memo continued: 


The problem with the unseating of the secondary O-ring 
during joint rotation has been known for quite some time. 
In order to eliminate this problem on the FWC field joints 
a capture feature was designed which prevents the second- 
ary seal from lifting off.?5 


Lastly the memo noted: 


The present consensus is that if the primary O-ring seats 
during ignition, and subsequently fails, the unseated sec- 
ondary O-ring will not serve its intended purpose as a re- 
dundant seal. However, redundancy does exist during the 
ignition cycle, which is the most critical time.?9 (See Ap- 
pendices VII-B and VII-C.) 


On August 2, 1985, Larry Wear, MSFC’s SRM Element Manager, 
sent a letter to Joseph Kilminster, Thiokol’s Vice President for 
Space Booster Programs, on the subject of SRM field joint second- 


j г Aiet DE Davids, “Саве to Case and Nozzle to Case 'O' Ring Seal Erosion Problems," 
u , 1985. 
23a Mr. Weeks, Dep. Assoc. Administrator for Space Flight (Technical); Mr. Hamby, Dep. Dir., 
STS Program Integration; Mr. Herrington, pa Dir. of Launch & Landing Operations; and Mr. 
Winterhalter, Acting Dir., Shuttle Propulsion Div. 

24 Ibid., р. 2. 

25 Ibid. 
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ary O-ring lift-off during pressurization. The letter concerned the 
situation wherein one O-ring might not seal subsequent to joint ro- 
tation. The letter stated: 


Because of recent experiences of flight and ground test 
motors having increasing incidences of putty blow-holes 
and the associated burning of primary O-ring, it would 
seem prudent for us to attempt to assure that the second- 
ayy O-ring is capable of sealing during the entire SRM 

urn. 


The letter requested an assessment of the possibility of lift-off of 
the secondary O-ring. 

In August of 1985 Jim Thomas, MSFC’s Deputy SRM Element 
Manager, wrote a memo for Mr. Mulloy to Mr. Hamby at NASA 
Headquarters, which was apparently never signed or sent. The sub- 
ject of the memo was SRM Joint/O-ring Erosion. The memo stated: 


On July 11, 1985, you and Irv Davids were briefed by 
Jim Thomas of my office on the history of the effort under- 
way to resolve the issues and concerns of the above sub- 
ject. 


The memo than went on to discuss a number of questions. 


1. What would happen if the secondary seal lifted off the mating 
surface during motor pressurization, and, also, how long it would 
take for the seal to return to a position where contact was made? 
The answer to that question stated that bench test data indicated 
that the O-ring resiliency, that is, its capability to fill the gap be- 
tween the tang and the clevis, was a function of temperature and 
the rate at which the gap opened. 

The memo stated, “аў 100 deg. F the O-ring maintained contact. 
At 75 deg. F the O-ring lost contact for 2.4 seconds. At 50 deg. F 
the O-ring did not reestablish contact in 10 minutes at which time 
the test was terminated.” The memo then stated, "the conclusion is 
that secondary sealing capability in the SRM field joint cannot be 
guaranteed." 28 


2. Another question concerned whether or not the secondary O- 
ring would seal in sufficient time to prevent joint leakage if the 
primary O-ring had not sealed. The answer to that question was as 
follows: 


MTI has no reason to suspect that the primary seal 
would ever fail after pressure equilibrium is reached, i.e., 
after the ignition transient. If the primary O-ring were to 
fail from 0 to 170 milliseconds, there is a very high proba- 
bility that the secondary O-ring would hold pressure since 
the case has not expanded appreciable at this point. If the 
primary seal were to fail from 170 to 330 milliseconds, the 
probability of the secondary seal holding is reduced. From 
330 to 600 milliseconds the chance of the secondary seal 


27 NASA, Larry Wear, “SRM Field Joint Secondary O-ring Lift-Off During Pressurization,” 
SA 41-326-85, August 2, 1985. 

28 Engineering consultants to the Committee have serious questions as to how this test relates 
to actual O-ring performance in flight hardware. 
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holding is small. This is direct result of the О-г 8 slow 
response compared to the metal-case segments as the joint 
rotates. 


3. The third question indicated that NASA Headquarters was not 
aware that the secondary O-ring may not seat due to joint rotation, 
and they wanted to know when this data was incorporated into the 
FMEA/CIL? The answer noted that Thiokol had submitted a TWR- 
13520 to MSFC in December of 1982. This was approved by NASA 
Level ПІ on January 21, 1983. NASA Level П authorized a change 
request March 2, 1983 and Level II issued a PRCBD to implement 
approved Level I change request on May 2, 1983.29 

Thiokol completed their engineering study of O-ring compression 
set and dated the report October 2, 1985.30 (Compression set relates 
to the ability of a material, in this case, O-rings, to rebound to its 
original dimensions after having being subjected to compression for 
various periods of time and or at various temperatures.) That 
report contained the following information. There was a concern of 
the ability of the O-ring to rebound to or near its original dimen- 
sions after having been subjected to compression for various peri- 
ods of time and at various temperatures. The Parker Seal Company 
of Culver City, California, tested several O-rings to determine the 
properties of the material. Two compression set tests in accordance 
with ASTM (American Society for Testing and Materials) D-395 
method B were performed.?! The first test was conducted at а con- 
stant temperature of 75 deg. and the time that the ring was in 
compression was varied. In the second test the temperature was 
varied and the compression was held constant. A small O-ring of 
0.139 inch diameter was used for test purposes. The test showed 
that the percentage of compression increased with an increase of 
temperature. However, these tests were not conducted at low tem- 
peratures. Rather, they were conducted at temperatures of 212 deg. 
F and above and therefore, they have little relevance to ambient 
conditions. | 

А status report from Thiokol’s SRM O-ring Task Force, present- 
ed on November 20, 1985, recommended that a slightly larger 
Viton O-ring of 0.292 inch diameter, along with thicker shims, be 
used as a short-term solution. The current O-rings were 0.280 
inches. Thiokol pointed out that there would be more erosion 
margin due to greater material thickness at the sealing surface. 
They noted that the thicker shims would reduce the initial and ab- 
solute final gap opening dimension, resulting in more O-ring 
“squeeze” initially. Thiokol stated that the greater initial squeeze 
would be better for compression set and resiliency, and would give 
a higher probability of maintaining a secondary seal longer into 
the ignition transient. Thiokol also noted that various tests were 
conducted on the Randolph putty using hot five-inch char 
motors.?? Two tests were conducted, which determined that the 


29 NASA, Larry Mulloy, "SRM Joint/O-ring Erosion," SA 42-349-85, August 1985, pp. 1-2. 

30 Thickol, B.L. Orme, "Enginering Study of O-ring Compression Set," R-15218, October 2, 
1985. 
3! Refer to Appendix VII-A for ASTM specification. 
3?Small scale test motors. 
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putty erosion could take place at а rate between 5.5 and 13.0 mils 
per second. Two other tests noted that the erosion on GS-43 33 
putty was ten times higher than that on the Randolph.?* 

Primary concerns drawn from the charts provided by Thiokol on 
January 27, 1986, centered around the following items. During the 
ignition transient, 0 to 170 milliseconds, there is a high probability 
of a reliable secondary seal. Between 170 and 880 milliseconds 
there is a reduced probability of a reliable secondary seal and be- 
tween 880 and 600 milliseconds there is a high probability of no 
secondary seal capability. Under steady state conditions, between 
600 milliseconds and two minutes, the notes states “if erosion pene- 
trates primary O-ring seal—high probability of no secondary seal 
capability.” 35 

A. Bench testing showed O-ring not capable of maintaining con- 
tact with metal parts gap opening rate to MEOP. 

B. Bench testing showed capability to maintain O-ring contact 
during initial phase (0 to 170 ms) of transient. 36 

What follows is taken from Chart 2-2: 

1. A temperature lower than current data base results in 
changing primary O-ring sealing timing function. 
2. SRM 15-A 80 deg. arc black grease between O-rings. SRM 
15-B 110 deg. arc black grease between O-rings. 
3. Lower O-ring squeeze due to lower temperature. 
4. Higher O-ring Shore hardness. 
5. Thicker grease viscosity. 
6. Higher O-ring pressure activation time. 
7. Activation time increases, threshold of secondary seal 
pressurization capability is approached. 
8. If threshold is reached then secondary seal may not be ca- 
pable of being pressurized.?? 

The presentation went on to included the following blow-by 

history: 
SRM 15 worst blow-by. 
A. Two case joints (80 deg.), (110 deg.) arc. 
В. Much worse visually than SRM 22. SRM blow-by.?* | 

The presentation then included a chart titled “O-ring (Viton) 
Shore Hardness vs. Temperature.” 39 


Degree F Shore Hardness 
70 degrees 77 hardness 
60 degrees 81 hardness 
50 degrees 84 hardness 
40 degrees 88 hardness 
30 degrees 92 hardness 
20 degrees 94 hardness 
10 degrees 96 hardness 


33 A type of putty made by another company that also was considered for use in the SRM. 

34 Thiokol, “SRM O-ring Task Force Status and QM-5 Recommendations,” TWR-15349, Мо- 
vember 20, 1985. 

35 Thiokol, "Temperature Concern on SRM Joints,” January 27, 1986, chart 2-1. 

зе ТЫ. 

37 Ibid., Chart 2 2. 

зв Ibid., Chart 8-1. 

39 Ibid., Chart 4-1. 
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The term Shore Hardness refers to а method of identifying the 
hardness of materials, and a higher number means a harder mate- 
rial. Regardiess, though, it is seen from the above table that the 
hardness increases as the temperature decreases. Engineers pre- 
sented a chart titled Secondary O-ring Resiliency, listing the fol- 
lowing temperatures.*° 


Temperature degree F Time to recover (seconds) 
50 degree 600 recover 
75 degree 2.4 recover 
100 degree *did not separate 


The conclusions presented at the end of the teleconference were: 
1. Temperature of O-ring is not only parameter controlling 
blow-by. SRM 15 with blow-by at an O-ring temperature at 53 
deg. F. SRM 22 with blow-by at an O-ring temperature at 75 
deg. F. Four development motors with no blow-by were tested 
at O-ring temperature of 47 deg. to 52 deg. F. Development 
motors had putty packing which resulted in better perform- 
ance. 
2. At about 50 deg. F blow-by could be experienced in case 
joints. 
3. Temperature for SRM 25 on 1/28/86 will be 29 deg. F 9:00 
a.m., 32 deg. К. 2:00 p.m. 
4. Have no data that would indicate SRM 25 is different 
than SRM 15 other than temperature.*! 
Recommendations 
]. O-ring temperature must be greater than or equal to 53 
deg. F at launch. Development motors at 47 deg. to 52 deg. F 
with putty packing had no blow-by. SRM 15 (the best simula- 
tion) worked at 53 deg. F. 
2. Project ambient conditons (temperature and wind) to de- 
termine launch time.*? 
The effect of Thiokol's recommendations would be that the Shut- 
tle should not be launched unless the O-ring seal temperature was 
at least 53°F. 


(e) Loads Acting on the Joint 


There are other loads on the joint in addition to those caused by 
the pressures of the burning propellant. The following table identi- 
fies those loads relative to time.*? 


Time Activity Source of load Static or dynamic impact on joint 


Days before launch .......... Mating of casing.............. Weight of upper casing Static plus impact ........ Physical contact 
contacting lower between tang and 
casing. clevis. 


40 Ibid., Chart 4-2. 

41 Ibid., Chart “Conclusions.” 

42 Ibid., Chart “Recommendations.” 

43 This Chart was prepared by the Committee and is based on information obtained by Com- 
mittee staff during meetings at MSFC on June 30, 1986. 
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Тіте 


Activity 


Source of load 


Static or dynamic 


Impact on joint 


Days before launch .......... 


Days before launch .......... 


Days before launch .......... 


Days before launch 


Within 24 hours of 
launch. 

Within 24 hours of 
launch. 


6 seconds to launch ........ 


At start of launch............ 


At start of launch............ 


At start of launch............ 


Ае ане 


Launch рћаѕе................... 


Launch рћазе................... 


Launch рпазе................... 


Launch рпазе................... 


Separation phase.............. 


Solid rocket motor 
assembly (Stacking) 
at KSC. 


Joining of the external 
tank, and orbiter to 
SRB’s. 


Transport to pad on 
crawler. 


Addition of payloads 


Loading of Їшеї................ 


Loading of fuel ................ 


Firing of main engines 
(SSME’s). 


Solid rocket motor 
ignition before lift-off. 


Solid rocket motor 
ignition before liftoff. 


Release of hold down 
bolts. 


Launch maneuvering ........ 


In-flight maneuvering ....... 


Turbulence—wind gust 
loads. 


Reduction of main 
engine power and 
Solid Rocket Motor 
thrust at Max q 
(maximum dynamic 
pressure). 

Increases in thrust 
thrust of main 
engines and solid 
rocket motors. 

Burning out of solid 
propellants and 
explosive forces at 
attachment points. 


Weight of SRB 
components. 


Additional weight of tank 
and orbiter. 


Movement of Transporter ... 


Added weight ..................... 


Weight of liquid hydrogen 
and liquid oxygen. 

External tank contracts in 
diameter due to 
reduction in 
temperature. 


Thrust of engines............... 


Combustion pressures......... 


Engine thrust ..................... 


Instant release of lateral 
force at aft External 
Tank attachment 
structure. 

Thrust, plus nozzle vector 
forces. 


Thrust plus gimbaling, 
applied loads at 
attachments. 

Impact, thrust nozzle 
gimbaling (changes in 
applied loads). 


Decrease in thrust.............. 


increase in thrust............... 


Release of thrust, impact 
forces at attachment 
points. 


SBC о ода адын. 


${айс............................ 


Static and dynamic....... 


Static css 


Static: а. 


айс, оаа 


Static and dynamic....... 


Basically static ............. 


Static and dynamic....... 


Dynamic........................ 


Static and dynamic....... 


Static and dynamic....... 


Static and dynamic....... 


Static and дулатіс....... 


Static and dynamic....... 


Static and dynamic....... 


Compressive; shear on 
pins at faces 
between tang and 
each clevis leg. 

Compressive; additional 
shear on pins which 
connect tang [0 
clevis. 

Compressive; slight 
shear changes on 
pins. 

Additional compressive 
and shear loads. 

Additional compressive 
and shear loads. 

Lateral tensile force 
applied by aft 
attachment structure 
between external 
tank and solid rocket 
motor casing. 

Further moments 
compressive and 
vibratory (25 to 30 
Нг). 

Bending (Joint rotation) 
lateral forces 
perpendicular to 
casing walis. 

Instant load reversal 
from compressive to 
tensile in joints and 
instant shear reversal 
in pins. 

Instant change in 
stress, vibratory at 3 
Hz. 


Combination: Vibration, 
tensile, shear, Jateral 
(via attachment 
Structure). 

Combination vibration, 
tensile, shear, lateral. 


Impact loads 
transmitted to joints. 


Changes in bending and 
Stress in joint, 
changes in frequency 
of vibration. 


Changes in bending and 
stress in joint and in 
vibration. 


Reduction of tensile 
forces and shear on 
pins. 
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Тіте Activity Source of load Static or dynamic Impact on joint 
Ocean impact and Weight of SRB Impact оп joint .................. Dynamic........................ Variation in stresses at 
retrieval. impacting ocean at joints. 
about 60 mph 


(vertical) 25 mph 
(horizontal). 


How these loads are accommodated by the joint is critical to the 
seal. In Thiokol's analytical evaluation report (TWR-12019, dated 
October 6, 1978), S. Stein of the Structures Section included the 
statement, "except in local area of pin, all stress levels are consid- 
erably below yield." 438 As a result of this information, the Com- 
mittee will explore this condition as part of its normal oversight 
work to determine the long-term effect on structural integrity of 
the casings.** Stein also wrote, “at MEOP [maximum expected op- 
erating pressure] the primary 'O' ring gap increases 0.052 and the 
secondary 0.038”.” *5 It should be noted however, the analysis was 
made for no thrust, i.e. internal pressure only.*9 As noted on the 
forgoing chart, loads on the joint do work in combination and so 
the analysis should also provide for the combined effect of all loads 
at the time they occur. 

On page 55 of the Rogers Commission Report there is a chart 
which shows a series of curves which relate maximum aerodynam- 
ic force to Mach Number. As a result of a discussion with Dr. Rich- 
ard Feynman, Department of Physics, California Institute of Tech- 
nology, and a member of the Rogers Commission, the Committee 
will review these curves after the completion of this report in an 
effort to ascertain their validity. There is reason to suspect that the 
"flight envelope" as repressented in the chart is inaccurate.*7 

As stated previously, the proper choice of materials is critical to 
attaining performance objectives. The steel casings are designed to 
withstand the propellant pressures and loads incurred in flight. 
Secondly, they must accommodate these forces over and over as the 
casings are reused. Consequently, the choices of the type of steel 
selected was important. 

The steel used to make the casings and the joint is a D-6A. D-6A 
is a low-alloy steel for aircraft and missile structural applications. 
It is designed primarily for use at room-temperature tensile 
strengths of 260 to 290 ksi.48 D-6A maintains a very high ratio of 
yield structure to tensile strength up to a tensile strength of 280 
ksi, combined with good ductility. 

Typical mechanical properties of D-6A steel: *9 


4% Thiokol, S. Stein, "Analytical Evaluation of the при Shuttle Solid Rocket Motor Tang/ 
Clevis Joint Behavior”, TWR- 12019, October 6, 1978, p. 

44 Thiokol, 8. Stein, “Analytical Evaluation of с Shuttle SRM Tang/Clevis Joint Behav- 
ior", TWR- 12019, October 6, 1978. 

45 b id. 

46 [bid. 

47 Discussion with Dr. Richard Feynman, California Institute of Technology, Pasadena, Cali- 
fornia, September 3, 1986. 

48 1000 pounds per square inch equals 1 ksi. 

19 American Society for Metals, Handbook Edited by H.E. Boyer and T.L. Gall, November, 
1984. 
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Tempering temperature 


: Elongation іп 50 
: Шыға Yield strength ksi mm or 2 іп, 
с F percent 


Reduction in area, V-notch impact 
percent energy ft-lb 


150 300 299 211 8.5 190 10 
205 400 290 235 8.9 25.7 1 
315 600 267 247 8.1 30.0 12 
425 800 236 228 9.6 36.8 12 
540 1,000 210 204 13.0 45.5 19 


650 1,200 150 141 18.4 60.8 30 


— — — — — 


Normalized at 990°C (1650°F) and tempered at various temperatures. 


In addition to the steel, other principal materials in the joint 
design that were to seal in the propellant gases were the zinc chro- 
mate putty and the O-rings. 

On April 12, 1984, John Miller, Chief of the Solid Motor Branch 
of NASA, wrote a memo to Mr. Horton, Chief Engineer, SRB Engi- 
neering Office, MSFC which referred to concerns with putty made 
by Randolph. The Randolph putty was selected on the basis that it 
had several desirable performance characteristics. The change in 
putty was made after Fuller-O’Brien discontinued making putty be- 
cause their product contained asbestos. Mr. Miller noted, “Stacking 
difficulties and observed O-ring anomalies appear to be more fre- 
quent with Randolph putty than with the previously used Fuller- 
O’Brien putty.” 5° Miller requested that Thioko! expedite develop- 
ment and qualification of a putty with properties similar to those 
of Fuller-O’Brien. 

On June 18, 1984, Miller wrote Horton again, mentioning ero- 
sion/heat exposure O-ring experience on QM-4, STS-2, STS-6, 
STS-11, and STS-13 and citing Deficiency Reports which violated 
specifications.5! 

By June 29, 1984, 5 inch motor tests has been completed. These 
tests substantiated the concept of hot gas jet impingement against 
O-rings. Interestingly, a simulation of "по putty” yielded no O-ring 
damage. This information was conveyed to NASA via telecon from 
Thiokol, which also stated that there was no second source for the 
Randolph putty. Thiokol had abandoned their program to mix the 
putty themselves. Measures taken to correct the putty problems in- 
cluded changes in the putty layup to reduce air entrapment, use of 
a porous sacrificial heat barrier such as carborundum fiberfrax or 
removing the putty and reducing joint gaps were іпігодисей.?? 

A new joint design was forwarded to NASA by Thiokol on July 
19, 1984, which included a fill capture feature. This feature looked 
similar to the "capture feature" proposed for future Shuttle flights. 
The fill capture feature, however, was to be filled with grease. A 
thermal analysis had shown that “severe heat effects would result 
if the cavity were not filled.” 

As stated previously, the putty was to insulate the O-ring seals 
from the hot propellant gases. It was also to remain flexible 
enough to move outward under the pressure of the burning propel- 
lant, thereby compressing the gas in the joint which, in turn, was 


50 NASA, John Miller, “Concerns with Randolph Vacuum Putty,” ЕР-25 (84-35), April 12, 
1984 


51 NASA, John Miller, “Zinc Chromate Putty Installation in Nozzle to Case Joint Discrepan- 
су,” ЕР-25 (84-53), June 18, 1984. 
52 Thiokol, "Vacuum Putty Telecon," June 29, 1984. 
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to seat the primary O-ring. O-rings require some pressure from the 
working fluid, in the case of the SRM, this was gas, in order to seat 
properly and provide a effective seal. In practice, this design philos- 
ophy did not prove to be correct because the putty frequently held 
the pressure off of the O-rings, or if it did not, the putty had blow- 
holes in it. It was then postulated that these holes might actually 
benefit the seating of the O-ring by allowing more pressure to 
reach it sooner. It was even suggested that holes might be deliber- 
ately made through the putty. However, it was then learned that 
blowholes served to concentrate propellant gas on small segments 
of the primary O-ring and caused the ring to erode. 

The unacceptable heat erosion damage to both primary and sec- 
ondary O-rings on SRM-16A resulted in an evaluation of the putty 
produced by Randolph Products. In July 1985, L. Thompson of 
MSFC made a presentation which noted that five different types of 
putty from four companies were under study in an effort to solve 
the putty performance problem. As late as 1985 twelve different 
types of tests had been performed and six more were in progress. 
The only putty to survive the water tests was General Sealants No. 
48, which was a non-asbestos formulation. The Randolph putty had 
disintegrated in all three water tests. However, in comparing dy- 
namic viscosity to temperature, the General Sealants product, at 
25,000 роіѕе,53 was not viscous above 125 deg C. It was slightly 
better than the Randolph product and another product made by 
Inmont. The previously used Fuller-O'Brien product, however, in- 
creased in dynamic viscosity with an increase in temperature. It 
was 100,000 poise at 250 deg C, while it was less than 50,000 at 50 
deg C.5* Consequently, no product met all the design requirements 
as well as the Fuller-O'Brien did. 

The Randolph putty is hydroscopic and its behavior is unsuited 
to use in the dry climate of Utah, as well as the humid climate of 
the Florida coast. In one case the putty was too stiff and in the 
other, too sticky. Since both factory and field joints required the 
use of the putty, a product with consistent performance in both cli- 
mates was required. 

The materials used in the manufacture of the O-rings was also 
critical to the safe operation of the Shuttle system. The O-rings had 
to be serviceable at the high temperatures in the joint which would 
result from heat transfer from the rocket combustion chamber. 
However, the use of NBR insulation around the propellant, and the 
use of putty, was to protect the steel casings and the O-rings from 
the direct heat of the propellant gases. This protection was not 
always successful when blowholes in the putty occurred, however, 
and the O-rings would frequently be damaged by heat. The lower 
temperatures that occur in Florida during the winter months was 
not covered by NASA's specifications. While elastomers are known 
to become brittle at low temperatures, a product specification sheet 
on Viton Fluroelastomer claimed, “Cold-VITON is generally serv- 
iceable in dynamic applications down to —18 to —23 deg C (0 to 10 
deg Е).”55 The sheet added: "The brittle point of Viton at a thick- 


53 Poise is a measure of viscosity or resistance to flow. 
5* NASA, L.M. Thompson, "SRM/SRB Putty Evaluation," July, 1985. 
55 ЗМ. Chemical Division, “Viton Fluoroelastomer," Undated, р. 1. 
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ness of 0.075 inches is in the neighborhood of 50 deg К. Yet, as with 
other elastomers, thickness has a marked effect upon low tempera- 
ture flexibility. Thinner cross-sections are more flexible than thick- 
er ones at every temperature.” The thickness of the O-rings on the 
Shuttle is 0.280 inches, thicker than the 0.075 inch article with a 
brittle point of 50 deg F noted above.5 Consequently, the brittle 
point of Viton was misleading since the O-rings were much larger 
the the test specimen. 

Military Specification MIL-R-83248A, 17 Feb. 84, "Rubber, Fluo- 
rocarbon Elastomer, High Temperature, Fluid, and Compression 
Set Resistant" set the specification for the O-rings that Thiokol had 
to meet.57 They included: 

Type І-О-гіпрв and compression seals Class 1-75 +/—5 Hard- 
ness 

This specification then included other specifications issued by the 
Society of Automotive Engineers and the American Society for 
Testing Materials. One of the ASTM Specifications listed was 
ASTM 1329, "Evaluating Rubber Property, Retraction at Low Tem- 
peratures."59 It was these referenced specifications which defined 
the significant characteristics required. 

On February 6, 1979, Mr. William Ray of NASA's Marshall 
Space Flight Center, sent а memo to Messrs Hardy, Rice, Eudy, 
and McCool (See Appendix V-I). That memo was essentially a trip 
report of Mr. Ray's visits to the Precision Rubber Products Compa- 
ny and the Parker Seal Company, in search of information on the 
performance of O-rings. Some of the points covered in the memo 
were: 


The purpose of the visits was to present the O-ring seal 
manufacturers with data concerning the large O-ring ex- 
trusion gaps being experienced on the Space Shuttle Solid 
Rocket Motor clevis joints and to seek opinions regarding 
the potential risks involved.®° 
With regard to the visit with company officials at Preci- 
sion Rubber Products, "they voiced concern for the design, 
stating that the SRM O-ring extrusion gap was larger than 
that covered by their experience." 61 

In response to the data presented to Parker Seal Compa- 
ny officials by Mr. Ray, Parker officials "also expressed 
surprise that the seal had performed so well in the present 
application." 9? 

Regarding the visit with the Parker officials, the memo 
stated, "their first thought was the O-ring was being asked 
to perform beyond its intended design and that a different 
type of seal should be considered." 93 


56 Ibid. 

57 Department of Defense, „Ша. Specification: Rubber, Fluorocarbon Elastomer, High 
Е шы Fluid, and Compression Set Resistant", MIL-R-83248A, February 17, 1984. 

58 Ibid, р. 1. 

59 Thid., р. 3. . . | 

60 NASA memorandum, William Ray, ‘Visit to Precision Rubber Products Corporation and 
Parker Seal Company”, EP 25 (19-23), February 6, 1979, p. 1. 

81 Thid 


вз Ibid., р. 2. 
өз Ibid 


205 


The need for additional testing of the present design was 
also discussed and it was agreed that tests which more 
closely simulate actual conditions should be done.®4 


As a result of the foregoing data, the Committee has arrived at 
the specific Findings and Recommendations contained in Chapter 
V. 


84 [bid. 


VIII. LAUNCH OPERATIONS 


INTRODUCTION 


The purpose of this section is to document the series of decisions 
that culminated in the launch of STS 51-L on January 28, 1986. In 
Section A, the discussion details the Flight Readiness Reviews used 
to assess the mission's readiness, and also describes the teleconfer- 
ence on the night of January 27 when Thiokol engineers attempted 
to delay the launch. Also discussed are the circumstances sur- 
rounding the uncertainty represented by ice covering the launch 
pad's gantry. 

Section B describes a specific example where the launch crew in 
the Firing Room waived a launch commit criterion. The discussions 
that took place on the subject indicate that the alternate procedure 
used as a justification for the waiver should not have been allowed, 
since the environmental conditions on the morning of January 28 
were outside the limits specified for the alternate procedure. 


A. THE STS 51-L LAUNCH DECISION 


Discussion 


Before each flight of the Space Shuttle, the ground support team 
carries out a series of meetings that are collectively known as the 
Flight Readiness Review. Policy guidance for this procedure is sup- 
plied by NASA Program Directive 710.5A, which states: 


It is the policy of the Associate Administrator for Space 
Flight (AA-SF) to make an assessment of mission readi- 
ness prior to each flight. This will be accomplished by a 
consolidated Flight Readiness Review (FRR) of all activi- 
ties/elements necessary for safe and successful conduct of 
the launch, flight, and post-landing operations. . . . The 
FRR will be preceded by detailed readiness reviews (pre- 
FRR's) on individual elements, including cargo, under the 
cognizance of the responsible Managers.! 


The FRR policy directive offers the following guidance to project 
and program managers regarding the expected content of their 
presentations: 


The Project/Element Managers will conduct pre-FRR’s 
to develop their readiness assessment and are responsible 
for the FRR briefing content in their particular area.? 


As for the agenda at these reviews, the directive has this to say: 


1 James Abrahamson, NASA, Headquarters, “Space Shuttle Flight Readiness Reviews," SFO- 
PD 710.5A, September 26, 1983, p. 1. See Appendix VIII-A. 
? Tbid., pp. 1-2. 
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The presentation of agenda items will normally include 
a brief status summary with appropriate supporting detail 
on significant items and conclude with a readiness assess- 
ment. The presentation topics and scope should be devel- 
oped from the pre-FRR’s and should: 

(1) be that required to provide the AA-SF with the in- 
formation needed to make a judgment as to flight readi- 
ness; 

(2) review recent significant resolved problems and prior 
flight anomalies when necessary to establish confidence; 

(3) cover all problems, open items and constraints re- 
maining to be resolved before the mission; 

(4) establish the mission baseline configuration in terms 
of all significant changes since the last STS mission 
(changes to be considered include hardware, software, vehi- 
cle servicing/checkout, launch commit criteria, flight 
plans, flight rules and crew procedures); 

Within the above guidelines, the scope of the review 
should cover status and issues in areas such as: vehicle 
checkout, shortages and open work, unexplained anoma- 
lies, hardware failures, prior flight anomalies, certifica- 
tion/verification, as-built hardware configuration versus 
certified hardware list, Critical Items List (CIL), develop- 
ment, qualification and reliability testing, waviers and de- 
viations, limited life components, launch critical spares, 
sneak circuits, system safety/hazards and flight mar- 
gins... .? 

In the case of STS 51-L, no deviation from normal procedure ap- 
parently occurred. This means that the Solid Rocket Motor, con- 
taining the seal that apparently failed, proceeded through the 
usual eight levels of review at Thiokol’s Wasatch Division, Mar- 
shall Space Flight Center, the STS Program Office at Johnson 
Space Flight Center, and the Associate Administrator's review at 
NASA Headquarters.* 

The Flight Readiness Review process for STS 51-L began on De- 
cember 11, 1985, at Thiokol's Utah plant. No information is pre- 
sented in the briefing charts used that day regarding the continu- 
ing failure of the SRM joint seals. The chart entitled “STS~61C 
(STS-32) (SRM-24) Performance “has only one entry: “TBD [to be 
determined]." 5 

Post-flight disassembly of STS 61-C SRB hardware following its 
launch on January 12 revealed that erosion of the primary O-ring 
had occurred in the aft field joint of the left motor. Hot gas had 
also bypassed the primary seal in the left nozzle joint. Erosion of 
the primary seal had also occurred in the nozzle joint of the right 
motor.$ 

Under the terms of the FRR Policy Directive, such damage 
would appear to require discussion: “the scope of the review should 


3 Tbid., pp. 2-3. 

s Tabie 1 (p е 44) indicates the date and scope for each of these eight reviews. -— 

5'Thiokol, Те 511, (575-33) Solid Rocket Motor (SRM-25) Flight Readiness Review," TWR- 
15380, December 11, 1985, chart 1-1. See Appendix VIII-B. 

6 Rogers Commission Report, Volume II, p. H-3. 


209 


— status and issues іп areas such аз... prior flight anoma- 
ies... .'7 

However, according to Mr. McDonald and Mr. Kennedy, Thiokol 
normally took about one week to prepare a discussion of problems 
— in the initial inspection following SRB hardware disassem- 

y. 

It would seem logical, when faced with the lack of data from the 
previous hardware set, to expand the search to other previously- 
flown hardware. On 61-A, hot gas had bypassed the primary seals 
in both the center and aft field joints of the left motor.® 

The right motor suffered erosion of the primary O-ring in the 
nozzle іоіпі.10 

The SRBs from 61-В suffered erosion of the seals in both nozzle 
joints, with gas bypassing the primary seal of the left nozzle.!! 

The Associate Administrator's policy directive is not alone in 
stressing that any available information capable of assisting with 
an assessment of flight readiness should be presented at a readi- 
ness review. Marshall's Shuttle Projects Office policy guidance uses 
virtually identical language. Under "Shuttle Policy Guidance," it 
states, "Review Concept: The Shuttle Projects FRR will employ a 
delta review concept from prior reviews and previous STS mis- 
sions." 1? 

In his letter announcing the STS 51-L Marshall Center FRR, Dr. 
Lucas wrote: 


Each project manager must certify the flight readiness 
of his hardware and present supporting rationale and data 
so the Board can independently assess the flight readiness 
... Emphasis will be placed on safety of flight and mis- 
sion success, including potential impact of prior flight 
anomalies.!? 


Apparent in the STS 51-L process, however, is that the continu- 
ing SRM seal problem did not receive such treatment. The “delta 
review concept" referred to above, according to Mr. McDonald, 
meant that the contractor was obligated to step back only to the 
previous mission for comparison.!* 

For 51-L, there was no previous mission to compare data with, 
since 61-C had not yet flown. Anomalies on STS 61-A and 61-B 
were not discussed, Mr. McDonald said, because they had already 
been dispositioned in the FRR’s for 61-B and 61-C.15 

The Marshall Space Flight Center FRR conducted by Dr. Lucas 
occurred only one day after the 61-C launch. Mulloy's presentation 


7 SFO-PD 710.5A, p. 3. 

8 Discussions with Allan McDonald and Carver Kennedy, Thiokol (Wasatch Operations), 
Brigham City, Utah, September 4, 1986. 

3 Rogers Commission Report, loc. cit. 

19 Ibid. 

11 ыа. 

12 Robert Lindstrom, NASA, Marshall Space Flight Center, "Shuttle Project Flight Readiness 
Review,” SOP 8000.1, December 29, 1983, p. 2. See Appendix VIII-C. 

13 William Lucas, NASA, Marshall Space Flight Center, “MSFC Flight Readiness Review 
ЕН Board for MSFC Elements for Mission 51-L," January 7, 1986, рр. 1-2. See Appendix 
VIII-D. 

14 Discussion with Mr. McDonald, September 4, 1986. 


15 Ibid 
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under STS 61-C performance noted that “all SRB systems func- 
tioned normally.” 18 

Under “ascent,” the chart shows “по anomalies.” 17 

There is no indication in the documentation for this FRR that 
the continuing problem with the SRM seals was raised. The para- 
chute recovery system was discussed at some length. Much of the 
presentation appears to be drawn from the booster assembly pres- 
entation made at МиПоу’в Level Ш FRR on January 8. The only 
relevant item that might refer to the O-rings appears under “Сегі- 
fication/Verification Status," where Mulloy stated that there were 
"то findings from continuing analyses that changes previously es- 
tablished rationale for flight. "18 

Mr. Mulloy's presentation at the January 15, 1986, Level 1 FRR 
does not indicate any serious problems with the SRB's. Documenta- 
Hon ade "Problems/Anomalies" lists "[n]o 61-C flight anoma- 
ies. 

Again, the focus of his presentation involved the changes made 
in the parachute recovery system. The SRM booster nozzle on STS 
51-L would be separated at the apogee of the SRB flight path (fol- 
lowing separation of the boosters from the Shuttle vehicle) to pro- 
tect the drogue parachute from debris, and the main parachutes 
were to be separated at water impact to reduce risks to the divers 
that assisted with recovery.?9 

Mulloy’s presentation to the Associate Administrator was not no- 
ticeably different from the presentation be made to Mr. Aldrich, 
the Shuttle Program Manager, at the Level П readiness review the 
day before. In fact, the briefing charts are identical.?! 

SRM seal erosion was ultimately raised during the STS-51L 
Flight Readiness Review cycle. Mr. McDonald stated that at the 
L-1 FRR Mr. Mulloy informed the Mission Management Team of the 
erosion damage seen on STS 61-C, characterizing it as ‘‘within the 
experience base." 22 

This evaluation of the seal erosion problem does not indicate the 
seriousness of the issue, and would not lead senior managers to a 
conclusion that the seal problem was a threat to the safety of the 
Shuttle. Given the historical treatment of the SRM seal problem in 
this process, however, it is not surprising that the STS 51-L re- 
views did not raise any new concerns about the integrity of the 
joint. 

This point is readily apparent in the Commission’s report. There 
is no implication that a serious problem exists, if Mr. Mulloy’s 
presentations are examined. The presentation made to Level 1 
during the STS 41-C FRR indicated that erosion was “acceptable,” 
and offered a rationale for accepting the possibility that the phe- 
nomenon would гесиг.23 


16 Larry Mulloy, NASA, Marshall Space Fight Center, “Center Board: STS-51L Flight Readi- 
ness AEN Solid Rocket Booster," January 18, 1986, Chart SRB-3. 
17 1 


Ibid. 

18 ТМ, Chart SRB-28. . 

1? Larry Mulloy, NASA, Marshall Ула» Flight Center, "978-511, Level I Flight Readiness 
Review,” January 15, 1986, Chart SRB-3. See Appendix УП-Е. 

20 [bid., Chart SRB-4. 

21 Larry Mulloy, NASA, Marshall Space Flight Center, "STS-51L Level II Flight Readiness 
Review," January 14, 1986. See Appendix VIII-F. 

22 Discussion with Allan McDonald, September 4, 1986. 

?3 Rogers Commission Report, Volume II. See Chart 15 (p. H-10) and Chart 19 (p. Н-12). 
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Indeed, Level 1 displayed more concern about the problem than 
did Marshall, since Dr. Hans Mark, then Deputy Administrator, di- 
rected Marshall to prepare a review of the seal erosion problems.24 

For mission 41-G, Mulloy argued that "Чеві shows maximum его- 
sion possible less than erosion allowable.” 25 

In his presentation to the STS 51-Е Level 1 FRR, Mulloy is seen 
on a videotape stating that: 


The rationale that was developed after observing this 
erosion on STS-11 [41-В] was that it was a limited dura- 
tion that was self-limiting in that as soon as the pressure 
in the cavity between the putty and the primary O-ring 
after the primary O-ring seats, or the pressure between 
the primary and the secondary O-ring equals the motor 
pressure, the flow stops and the erosion stops. The maxi- 
mum erosion that we have seen previously is 53 thou- 
sandths [of an inch]—that was back on STS-2. The erosion 
that we saw on 51-C was 10 thousandths of an inch on one 
O-ring and 38 thousandths on the other, so we believe that 
because of the limited exposure and the fact that the leak 
check assures that the secondary O-ring is properly sealing 
against motor pressure and the fact that the duration is 
limited, and that we can take 95 thousandths erosion on a 
primary O-ring and seal against 3,000 psi which is three 
times the motor pressure, that this represents an accepta- 
ble risk.?5 


Mulloy’s confidence that the SRM seal could take “95 thou- 
sandths erosion on a primary O-ring and seal against 3,000 psi 
which is three times the motor pressure, . . .” is based on comput- 
er modelling of the joint performance. Dr. Feynman’s analysis of 
the model, however, questions its use as the basis for declaring the 
seal problem “an acceptable risk." 


. . . This was а model based not on physical understand- 
ing but on empirical curve fitting. To be more detailed, it 
was supposed a stream of hot gas impinged on the O-ring 
material, and the heat was determind at the point of stag- 
nation (so far, with reasonable physical thermodynamic 
laws). But to determine how much rubber eroded it was as- 
sumed this depended only on this heat by a formula sug- 
gested by data on a similar material. A logarithmic plot 
suggested a straight line, so it was supposed that the ero- 
sion varied as the .58 power of the heat, the .58 being de- 
termined by a nearest fit. At any rate, adjusting some 
other numbers, it was determined that the model agreed 
with erosion (to depth of one-third the radius of the ring). 
There is nothing much so wrong with this as believing the 
answer! Uncertainties appear everywhere. How strong the 
gas stream might be was unpredictable, it depended on 
holes formed in the putty. Blow-by showed that the ring 
might fail even though not, or only partially eroded 


24 [bid., р. Н-13. 
25 Ibid., Chart 30 (p. H-18). 
26 Ibid., р. Н-42. 
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through. The empirical formula was known to Бе uncer- 
tain, for it did not go directly through the very data points 
by which it was determined. There were a cloud of points 
some twice above, and some twice below the fitted curve, 
so erosions twice predicted were reasonable from that 
cause alone. Similar uncertainties surrounded the other 
constants in the formula, etc., etc. When using a mathe- 
matical model careful attention must be given to uncer- 
tainties in the model.27 


Mr. Mulloy's analysis of erosion also notes that it was а "self-lim- 
iting" phenomenon, assuming that the damage ceased after the 
pressure built up against the seal. His analysis demonstrates that 
either the primary or the secondary seal would serve the purpose. 

On December 17, 1982, an amended version of the SRB Critical 
Items List was approved. It stated, “Leakage of the primary O-ring 
seal is classified as a single failure point due to possibility of loss of 
sealing at the secondary O-ring because of joint rotation after 
motor pressurization. [emphasis added)’ 28 

In the “Rationale for Retention," the document states, “Full re- 
dundancy exists at the moment of initial pressurization." 2? 

Mr. Mulloy read this to indicate that during the ignition tran- 
sient, the seal was a Critically 1R system, a redundant seal existed, 
and the secondary O-ring could be relied upon. After completion of 
the ignition transient (approximately 600 milliseconds), the joint 
became a Critically 1 system.?? 

Congressman Roe, however, said, 


We don't buy the point of view, do we measure other 
criticality points in degrees? My father taught те... [i]t 
is or it isnt . . . you took it from a КІ position and made 
it a number one position. You didn't qualify that, there is 
nothing in the record that qualifies it as half ап ЕЈ or 
three-quarters of an В1 in terms of temperature. . . . We 
didn't say we put them in there in number of degrees. We 
either did or we didn't.?! 


Implied in the presentation by Mr. Mulloy is that the Marshall 
and 'lhiokol engineers understood the joint's performance during 
the ignition transient. But, as Congressman Volkmer noted, 


Mr. VOLKMER. “. . . Mr. Mulloy, it says on page 148 [of 
the Commission's report] that prior to the accident neither 
NASA or Thiokol clearly understood the mechanism by 
which the joint sealing took place. Do you agree or dis- 
agree with that?" 

Mr. Mut oy. “I totally agree, sir." 32 


Also notable by its absence in Mulloy's presentation is the fact 
that STS 51-L had demonstrated an extreme example of blowby in 
the nozzle joint. It was this case that led Thiokol engineers to the 


27 Rogers Commission Report, Volume II, p. F-2. 

28 NASA, “SRB Critical Items List,” Page A-6A, December 17, 1982, Sheet 1. 
29 Тыа. 

39 Rogers Commission Report, Volume V, p. 834. 

3! Cmte Hgs., Transcript, June 17, 1986, p. 185. 

32 Ibid., р. 291. 
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conclusion that temperature was а contributing factor to joint 
damage. Mr. Boisjoly explained to General Kutyna that, based on 
photographs of the joints on 51-C (launched at a seal temperature 
of 53°F) and 61-A (launched at a seal temperature of 75°F), he 
“concluded, and so presented on the night before the launch . 
that jit was telling us that temperature was indeed a discriminator 


The appearance of the material that had bypassed the joint, ac- 
cording to Boisjoly, was significantly worse for 51C in appearance 
and extent. 

For mission 51-F, even after the failure of the primary seal in 
the 51-B nozzle joint, Mulloy's presentation to Level 1 listed the 
problem as “сїовеа.”34 

Chairman Roe, questioning witnesses from NASA on 17 June, 
learned that managers at Johnson and at Headquarters had not 
necessarily perceived the seriousness of the situation represented 
by the seal problem. 


Mr. Кок. “I would like to get Mr. Mulloy to answer the 
question—would you repeat the nine flights and tell the 
Committee at what level the O-ring problem was discussed 
and who was at that level? . . . You mentioned again, you 
listed the whole nine, and tell the Committee at what level 
the O-ring problem was discussed. We have been going on 
this for seven years and then who was at that meeting?" 

Mr. Моцоу. “Yes sir. I can answer part of your ques- 
tion. . . . І am reading from what was provided to me. It 
looks like it fits within the erosion. STS-11 [41-B], 41-C, 
41-G, 51-Е . . ., 51-Е..., 51-1, 51-J, 61-A . . ., and 61 
Bravo." 

Mr. Кок. “These were a problem with the O-rings and 
they were discussed at Level 1?” 

г. MuLLov. “Level 1 and Level 2." 

Mr. Roer. “Therefore it is inconceivable that Level 1, 
which ів top management, would not have understood the 
issue?’ 

Mr. Mu voy. “That is right, and I believe that has been 
acknowledged. .. .” 

Dr. GRAHAM. “We are in fact, reviewing the records to 
see who was at the various Flight Readiness Reviews that 
occurred when the O-ring data was mentioned, and we 
have not yet been able to pull that together. ... 

Mr. RoE. “So what you are basically saying is that 
Washington level knew of part of the problems; is that a 
fair comment?” 

Dr. GRAHAM. “There are two pieces to this: one, what 
was transmitted; and what was understood. I believe what 
Mr. Mulloy and Dr. Lucas are addressing is what was 
transmitted. I don’t know that they are the most appropri- 
ate people to express what was understood. That was a 
Headquarters issue and, in some cases, a Johnson Space 


эз ers Commission Report, Volume У, р. 784. 
34 ТЬМ., Chart 130 (p. Н-66). 
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Center issue. It is clear the issue was not perceived at the 
seriousness with which it actually affected the system. 
However, the information was transmitted to these agen- 
cies." 


Dr. Graham's statement is important when discussing the 
August 19, 1985, briefing on the joint seal problem. Thiokol and 
Marshall personnel did not communicate that the situation re- 
quired a halt in operations until the problem of seal erosion had 
been solved. It should also be noted that Mr. Moore was then occu- 
pied with the failure of the SSME temperature sensors (a failure 
which had led to premature shutdown of a main engine on flight 
STS 51-F and caused the first abort-to-orbit in the program's histo- 
ry) and so the briefing was attended by Mr. L. Michael Weeks, 
Deputy Associate Administrator (Technical) for Space Flight. A 
more complete analysis of his descripton of the situation to Mr. 
Moore is discussed іп the section on Technical Expertise.?$ 

Mr. Aldrich was not made aware of the briefing at all, removing 
Level 2 from the information flow.?? 

Levels 1 and 2 were not alone in their misapprehensions. the 
lack of understanding of the seal problem also appears in the pres- 
entations to Dr. Lucas and Mr. Reinartz at Marshall made by Mr. 
Mulloy. In the STS 61-C FRR cycle, immediately preceding 51-L, 
Mr. Mulloy was given an extensive discussion of the information 
obtained from STS 61-B, describing the damage to the seals, at the 
Level 3 SRB Project Office briefing he chaired.?? 

Mulloy's presentation to the Shuttle Projects Board then noted 
"SRM joint O-ring performance within experience base." 39 

In his presentation to the Level 1 FRR, however, Mulloy stated 
there were "по 61-B flight anomalies." *? 

In hindsight, a fundamental error that pervades the history of 
the seal erosion problem is this reliance on the "experience base" 
argument. Unwarranted confidence existed in the analysis of the 
joint seal erosion problem developed by Thiokol engineers and 
agreed to by Marshall's program office. There is a vital lesson to be 
learned in this episode, and it is best expressed by Henry Petroski, 
from the School of Engineering at Duke University. 


Dismissing the single structural failure as ап anomaly is 
never а wise course (emphasis added). The failure of any 
engineering structure is cause for concern, for a single in- 
cident can indicate a material flaw or design error that 
renders myriad structural successes irrelevant. . . . In en- 


35 Cmte Hgs, Transcript, June 17, 1986, pp. 203-206. 

36 Section VI.B.1.c. of this report. | 

зт “Тһе second breakdown in communications. . . ," Mr. Aldrich testified before the Commis- 
sion, “48 the situation of the variety of reviews that were conducted last summer between the 
NASA Headquarters Organization and the Marshall Organization on the [joint seal problem] 
and the fact that that was not brought through my office in either direction—that is, it was not 
worked through by the NASA Headquarters Organization nor when the Marshall Organization 
brought these concerns to be reported were we involved. And I believe that is a critical break- 
down in process and I think it is also against the documented reporting channels that the pro- 
gram is sup to operate to.” Rogers Commission Report, Volume V, p. 1490. 

ry Wear, NASA, Marshall Space Flight Center, “Flight Readiness Review SRM-24 (STS 

61-C),” December 2, 1985, Charts 3-2; 3-2B. Appendix II-G. 

БЫ — Commission Report, Volume II, р. Н-3. 
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gineering, numbers аге means, not ends, and it ought 
rightly to have taken only the failure of a single bridge to 
bring into question the integrity of every other span... . 
The common expectation of the engineer and the layman 
is that the road will not lead to bridges that collapse.*! 


Clearly evident is the fact that the Flight Readiness Review pro- 
cedure cannot compensate for poor engineering analysis. The FRR 
is similar to a checklist and will not necessarily discover problems 
not on the list. The technical rationale presented by Level 3 man- 
agers is assumed to reflect the best engineering judgment avail- 
able. Relying on this expertise, managers in more senior positions 
at NASA were misinformed regarding the severity of the problem 
of seal erosion and its critical importance to flight safety. 

The Committee is also concerned about the so-called "launch con- 
straint" imposed on the Shuttle system following STS 51-B, and 
the role this constraint was expected to play in the Flight Readi- 
ness Review process. The term “launch constraint" would seem to 
indicate that the Shuttle should not be launched until the problem 
giving rise to the constraint was solved. This is apparently not the 
case, according to Mr. Mulloy: 


The problem assessment system is in place at the Mar- 
shall Center as a tool to assure—it is a tool used by our 
quality and a reliability assurance organization to assure 
that problems that occur in flights and in ground test, in 
development, our qualification motor tests that would have 
a bearing on the flight or the upcoming flights, that that is 
documented and tracked. That problem assessment system 
shows in the case of the O-ring erosion, it shows essential- 
ly the same information, in many cases identical informa- 
tion to what is in the Flight Readiness Reviews. It is the 
basis for continuing to fly given the observations we are 
seeing.*? 

Testifying before the Commission, Mulloy had also made this 
distinction. 


Chairman ROGERS. "Let's go back just а bit, because I 
think it is helpful to me if you—you use words that I un- 
derstand a little bit. What caused the constraint to be put 
on in the first place?" 

Mr. Mulloy. "The constraint was put on after we saw 
the secondary O-ring erosion on the nozzle, I believe." 

Chairman Rocers. "Who decided that?" 

Mr. Момоу. “І decided that, that that [the joint seal 
erosion] would be addressed, until that problem was re- 
solved, it would be considered a launch constraint, and ad- 
dressed at Flight Readiness Reviews to assure that we 
were staying within our flight experience base. . . ." 

Dr. Ripe. “Why didn't you put a launch constraint on 
the field joint at the same time?" 


*! Henry Petroski, То ner is Human: The Role of Failure in Successful Design (New 
York: St. Martin's Press, 1985), pp. 69-13. 
42 Cmte Hgs, Transcript, June 17, 1986, р. 205. 
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Mr. Мшхоу. “I think at that point . . . the logic was 
that we had been discussing the field joint, the field and 
nozzle joint primary O-ring erosion. This erosion of [STS 
51-B's] secondary O-ring was a new and significant event, 
very new and significant event that we certainly did not 
understand. Everything up to that point had been that the 
primary O-ring, even though it does experience some ero- 
sion, does seal. What we had evidence of was that here was 
a case where the primary O-ring was violated and the sec- 
ondary O-ring was eroded, and that was considered to be a 
more serious observation than previously observed." *? 


The Marshall Space Flight System Problem Assessment System 
(PAS) was tracking the problem of nozzle joint primary O-ring ero- 
sion in Record A09288, “O-Ring Erosion in the Case to Nozzle 
Joint."** The record was apparently opened on July 10, 1985, some 
two months following the launch of STS 51-B on April 29, 1985. 
The last entry in this record is dated January 23, 1986, and begins 
"Resolution." It continues with a rationale for closing out the 
tracking record. Part of the rationale is quoted here: 


Analytical studies based on both impingement erosion 
and blowby erosion show that this phenomenon has an ac- 
ceptable ceiling since implementing the above changes [in 
performance of the seal leak check and in stacking proce- 
dures] Recent experience has been within the program 
data base. The seal improvement program plan will contin- 
ue until the problem has been isolated and damage elimi- 
nated to the SRM seals.*5 


An identical entry appears in PAS Record A07934, "Segment 
Joint Primary O-ring Charred." Though tracking problems with 
the field joint seals, work on the nozzle joint problem was included 
"as they are the same generic problem." 46 

The logic behind this “resolution” of the O-ring problem is not 
readily apparent. As the field joint tracking report notes, "The O- 
rings in the SRM segment ass[embll] joints are designed ав 
press[ure] seals & are not intended to be exposed to hot gases." 27 

Yet, in the rationale for closing out these tracking reports, it is 
stated that "[p]rimary O-ring erosion is expected to continue since 
no corrective action has been established that will prevent hot 
gases from reaching the primary O-ring cavity." 48 

The rationale ad described also appears to violate the directive, 
issued in 1980, that addresses the question of launch constraints. 
“АП open problems coded criticality, 1, ІК, 2 or 2R,” it stated: 


will be considered launch constraints until resolved (recur- 
rence control established and its implementation effecti- 
vity determined) or sufficient rationale, i.e., different con- 


*3 Rogers Commission Report, Volume V, p. 1510. | 

44 NASA, Marshall Space Flight Center, “O-Ring Erosion in the Case to Nozzle Joint," Prob- 
lem Assessment System Record Number A09288, February 26, 1986. See Appendix VIII-H. 

45 [bid., p. 2. 

46 NASA, Marshall] Space Flight Center, "Segment Joint Primary O-ring Charred," Problem 
— System Record Number A07934, March 7, 1986, р. 4. See Appendix VIII-I. 

47 Tbid., р. 1. 

48 Ibid., р. 5. 
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figuration, etc., exists to conclude that this problem will 
not occur on the flight vehicle during prelaunch, launch or 
flight.*? 


The Committee attributes this situation to the concept of “ас- 
ceptable erosion," which is more fully discussed in Chapter VII of 
this report. 

According to testimony before the Commission, these tracking 
records for O-ring erosion were closed out upon receipt of a letter 
from Mr. McDonald dated December 10, 1985.51 

This was apparently a mistake. Ав Mr. Mulloy and Mr. Wear ex- 
plained to the Commission, 


Mr. MurLoxv. “. . . Now, the entry that is shown in there 
that the problem was closed prior to 51-L is in error. What 
happened there was, one of your documents here which we 
did not discuss is the letter from Mr. McDonald to Mr. 
Wear which proposed that this problem be dropped from 
the problem assessment system and no longer be trapped 
[tracked] for the reasons stated in Mr. McDonald's letter. 
That letter was in the review cycle . . .. After Mr. Wear 
brought this letter to my attention, my reaction was, "ме 
are not going to drop this from the problem assessment 
system because the problem is not resolved and it has to 
be dealt with on a flight-by-flight basis. Since that was 
going through the review cycle, the people who run this 
problem assessment system erroneously entered a closure 
for the problem on the basis of this submittal from Thio- 
kol. Having done that, then for the 51-L review, this did 
not come up in the Flight Readiness Review as an open 
launch constraint, so you won't find a project signature be- 
cause the PAS system showed the problem was closed, and 
that was an error." 

Chairman Rocers. “Who made the error? Do you 
know?” 

Mr. Момоу. “The people who do the problem assess- 
ment system." 

Мг. Wear. “Мг. Fletcher, and he reports within our 
quality organization at the Flight Readiness Review, at the 
incremental Flight Readiness Reviews . . .. At my review 
and at Larry's review, there is a heads up given to the 
quality representative at that board for what problems the 
system has open, and they cross-check to make sure that 
we address that problem in the readiness review. On this 
particular occasion, there was no heads up given because 
their PAS system considered that action closed. That is un- 
fortunate." 52 


Mr. Mulloy's discussion with Chairman Roe, and his description 
provided to the Commission, indicate that the NASA Safety, Reli- 
ability and Quality Assurance (SR&QA) organization should play a 


49 Robert Lindstrom, NASA, Marshall Space Poeni Center, “Assigning Launch Constraints on 
Open Problems Submitted to MSFC PAS,” September 15, 1980, р. 1. See Appendix УШ-4. 

51 Rogers Commission Report, Volume V, p. 1509. 

52 bid. 
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significant role in the Flight Readiness Review process. The infor- 
mation available on this topic suggests that this was not the case. 
The Committee is concerned by the invisibility of SR&QA in this 
area. 

First, the number of people operating in the SR&QA organiza- 
tion has apparently been declining since the Apollo program. The 
decline at Marshall is among the most severe, according to NASA’s 
internal estimate.5* 

The obvious conclusion is that SR&QA has fewer people to over- 
see the myriad details involved in preparing for Flight Readiness 
Reviews, in addition to their other duties. 

Second, there is nothing to show what evaluation SR&QA person- 
nel had made of the joint seal erosion problem. The recurring 
nature of this problem, and the Criticality-1 status of the joint, 
argue that SR&QA should have paid close attention to this situa- 
tion, including the execution of an independent test program and 
presentations of their evaluation at Level 3 Flight Readiness Re- 
views. 

Third, though management of the PAS system is apparently the 
responsibility of the SR&QA organization, they appear to exercise 
little control. The system is operated under contract by Rockwell, 
data is entered by hardware manufacturers, and the only technical 
analysis that appears in the reports on joint seal erosion was devel- 
oped by Mr. Wear or his deputy, James Thomas, in the SRM pro- 
gram office. There is no input, either concurrence or dispute, regis- 
tered by SR&QA personnel. Even more important, as illustrated by 
Mr. Mulloy’s testimony, problem reports can too easily be removed 
from the system. 

Fourth, the PAS tracking records do not support the testimony of 
Mr. Mulloy and Mr. Wear before the Commission. The entry enti- 
tled “Resolution” is dated January 23, 1986, while the FRR in Mr. 
Wear’s SRM Project Office occurred on December 17, 1985, and the 
FRR in Mr. Mulloy’s SRB Project Office took place on January 3, 
1986. It is also interesting to note that the PAS Record, dated Feb- 
ruary 26, 1986, shows “Status Open.” 55 

If Mr. Mulloy’s and Mr. Wear’s testimony is accurate, SR&QA 
should still have raised the issue of seal erosion as a concern at 
their reviews. No evidence exists that this occurred. 

The Committee, however, is concerned not only about the 
SR&QA organization at Marshall. The Commission noted in its 
report that “(t]he Problem Reporting and Corrective Action docu- 
ment (JSC 08126A, paragraph 3.2d) requires project offices to 
inform Level II of launch constraints. That requirement was not 
met. Neither Level II nor Level I was informed.” 56 

Testifying before the Committee, however, Mr. Mulloy argued 
that both levels were informed. 


Mr. VoLKMER. “Even though . . . you continued to see 
erosion of the O-ring, you continued to waive the launch 
constraint?” 


53 See also “Safety, Reliability and Quality Assurance,” Section VI.B.2.c(2) of this report. 
54 This is documented in Section VI.B.2.c(1) of this report. 

55 PAS Record А09288, р. 1. 

55 Rogers Commission Report, Volume І, р. 159. 
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Mr. MurLov. “That is correct, sir, on the basis of the ra- 
tionale or the explanation as to why that was an accepta- 
ble risk that was presented to me by Morton ,Thiokol, re- 
viewed and approved by my management. . 

Mr. VOLKMER. “Was JSC [the Johnson Space Center] in- 
formed of the problem?" 

Mr. MuL Loy. “Through the Flight Readiness Review and 
through the submission of this problem to the problem 
tracking system at JSC. I do not know what distribution 
was made at JSC when it goes down there. The report also 
goes to the Chief Engineer's office at Headquarters." 

Mr. VOLKMER. “It is my understanding that we had 
some testimony earlier from Mr. Aldrich that he wasn't 
knowledgeable that there was a launch constraint." 

Mr. Милох. “That is entirely possible, sir, I don't know 
what distribution was made, and 1 have testified, and I 
think—I have testified that it wasn't briefed in the Levels 
2 and the Level 1. When I went—" 

Mr. VOLKMER. “That is right." 

Mr. Mulloy. “—that ‘we have a problem, the concern is 
flight safety, the rationale for continuing to fly is this.' 
That was not briefed in the context of 'this is a launch 
constraint in the problem assessment system,' and it is en- 
tirely possible that if that report, whatever distribution is 
made of that report at Houston, that he might not have 
seen that." 57 


It is quite likely that neither Mr. Moore nor Mr. Aldrich was 
made aware of the launch constraint on the SRM. SR&QA person- 
nel at Johnson and at NASA Headquarters should have received 
these reports described by Mr. Mulloy and tracked them as they 
did similar launch constraints on other Shuttle hardware. What 
steps they took to assure that these constraints were raised at the 
Flight Readiness Review for these management levels is less clear. 
The Committee's review of the FRR's for the six missions subject to 
the launch constraint on SRM nozzle joint seals does not indicate a 
greater level of discussion took place because the constraint was in 
force, except for the STS 51-F FRR where an explanation of the 
51-В failure was required. 

The rationale for closing out these problems on the problem as- 
sessment system stated that “status will continue to be provided in 
the Flight Readiness Reviews and in formal technical reviews at 
Thiokol and MSFC." 58 

Without a change in the prevailing technical evaluation of the 
problem, however, it is unlikely that proper action to correct the 
overall problem would have been undertaken. 

On the eve of the launch, Thiokol engineers attempted to change 
this prevailing technical evaluation. Їп a teleconference on the 
night of January 27, they presented data demonstrating that the 
low temperatures in the area would impair the function of the O- 
ring seals inside the joint. After NASA managers expressed con- 


51 Cmte Hgs Transc з Јипе 17, 1986, рр. 284-85. 
58 PAS Record А0928 
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cern about the delay such constraints would have оп the flight 
schedules, Thiokol’s management withdrew and met with their en- 
gineers again; only this time, the managers would not listen to fur- 
ther argument about aborting the flight. Thiokol then recommend- 
ed that the launch be allowed to proceed. 

Launch operations were terminated at 12:36 p.m. Eastern Stand- 
ard Time (EST) on January 27 because of high crosswinds at the 
launch site. At 2:00 p.m. EST, the Mission Management Team met 
and decided to attempt a launch at 9:38 a.m. EST January 28. The 
weather was expected to be clear but cold with temperatures in the 
low twenties. There were concerns about the facilities and various 
water drains but no concerns were expressed about the O-ring and 
the Solid Rocket Boosters. All members of the team were asked to 
review the situation and call if any problems arose. 

At Thiokol’s Wasatch Division in Utah, Mr. Robert Ebeling 59 
met with Mr. Boisjoly at about 2:30 p.m. Mountain Standard Time 
(MST) on the afternoon of January 27. They were joind by other 
Thiokol engineers. Mr. Ebeling was concerned about predicted cold 
temperatures at the Kennedy Space Center. When he was ques- 
tioned by the Rogers Commission he responded: 


. . . The meeting lasted one hour, but the conclusion of 
that meeting was engineering, epecially Arnie [Thompson], 
Roger Boisjoly, Brian Russell, myself, Jerry Burns, they 
come to mind, were very adamant about their concerns on 
this lower temperature, because we were way below our 
data base and we were way below what we qualified for.®° 


Later Mr. Ebeling called Mr. McDonald at the Kennedy Space 
Center. Mr. McDonald remembered the call, saying: 


He called me and said they had just received some word 
earlier that the weatherman was projecting temperatures 
as low as 18 degrees F [Fahrenheit] sometime in the early 
morning hours of the 28th and that they had some meet- 
ing with some of the engineering people and had some con- 
cerns about the O-rings getting to those kinds of tempera- 
tures.9! 


Mr. Ebeling wanted Mr. McDonald to get some accurate predict- 
ed temperatures for the Cape so he could make some calculations 
to determine what could be expected of the O-rings. McDonald told 
him he would get the temperature data for him and call him back. 
Mr. Carver Kennedy, Vice President of Space Services for Thiokol, 
working at the Kennedy Space Center, obtained the information. 
Mr. McDonald then relayed the information to Mr. Ebeling in 
Utah. The information indicated that the temperature was to get 
as low as 22° in the early morning hours, probably around 6:00 
a.m., and that they were predicting a temperature of about 26" at 
the intended time of launch, 9:38 a.m. on the 28th.9? 


59 Solid Rocket Motor Igniter and Final Assembly Manager, Thiokol. | 
во Thiokol, Robert Ebeling, Interview before the Presidential Commission оп the Space Shut- 

tle Challenger Accident, March 19, 1986, | 13. 
61 Rogers Commission Report, Volume ТУ, р. 715. 
52 Thid. 
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Mr. McDonald then called Mr. Cecil Houston, the Resident Man- 
ager for the Marshall office at Kennedy Space Center, and told him 
of Thiokol’s concerns with the low temperature and potential prob- 
lems with the O-rings. Mr. Houston said he would set up a telecon- 
ference including Marshall and personnel at Thiokol in Utah.®?* 


62a Table II lists the principal participants in the teleconference on January 27, 1986. 
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TABLE 11 


PRINCIPAL PARTICIPANTS IN THE TELECONFERENCE 
ON JANUARY 27, 1986 


At Kennedy Space Сепіег, Florida 


Thiokol Allan McDonald Director, 50114 Rocket Motor Program 
Of fice 

ТВ ІТ око! Јаск Висћапап Manager, KSC Resident Office 

MSFC Lawrence Mul toy Manager, Solid Rocket Booster Project 
Office 

MSFC Stanley Refnartz Manager, Shuttle Projects Office 

MSFC Judson Lovingood Deputy Manager, Shuttle Projects Office 


At Marshall Space Elight Center, Alabama 


MSFC George Hardy Deputy Director for 5сіепсе and 
Engineering 


At Thiokol Wasatch Operations, Utah 


Thiokol Jerald Mason Senior Vice President, Wasatch 
Operations 

Thiokol C.G. Wiggins Уїсе President and General Manager, 
Space Diviston 

Thtokol Robert Lund Vice Prestdent for Engineering 

Tht oko! Joseph КГІтіпетег Vice President, Space Booster Programs 

Thiokol Roger Bolsjoly Staff Engineer, Applied Mechanics 

Th t oko! Robert Ebel Ing Manager, SRM Ignition System, Final 


Assembly, Special Projects and Test 


Thiokol Агпо! d Thompson Supervisor, Structures Design 


228 


Mr. Houston then called Dr. Judson Lovingood, Deputy Shuttle 
Project Manager at Marshall, to inform him of the concerns about 
the O-rings. Mr. Houston asked Dr. Lovingood to set up a telecon- 
ference with senior project management personnel, including Mr. 
George Hardy, Deputy Director of Science and Engineering at Mar- 
shall, and with Thiokol personnel. Dr. Lovingood called Mr. Stan- 
ley Reinartz, Marshall’s Shuttle Project Office Manager, a few min- 
utes later and informed him of the planned teleconference. 

The first phase of the teleconference began at 5:54 p.m. EST and 
included Messrs. Reinartz, Lovingood, Hardy, and others at Kenne- 
dy, Marshall and Thiokol’s Wasatch plant. Concerns about the 
effect of low temperature of the O-rings and the joint seal were 
presented by Thiokol personnel, along with an opinion that launch 
should be delayed. 

A recommendation was also made that Arnold Aldrich, the 
Space Transportation System Program Manager, be told of the up- 
coming telecon and that the fact that Thiokol had expressed some 
concerns. Mr. Reinartz testified before the Commission that “уе 
did not have a full understanding of the situation as I understood 
it at that time, and felt that it was appropriate to do before we in- 
volved the Level II into the system.” 83 

Testifying before the Rogers Commission, Dr. Lovingood was 
asked whether the possibility of a launch delay had been men- 
tioned in this telcon on January 27. Dr. Lovingood replied: 


That is the way I heard it, and they were talking about 
the 51-C experience and the fact that they had experi- 
enced the worst case blow-by as far as arc and the soot and 
so forth. And also, they talked about the resiliency data 
that they had. 

So it appeared to me—and we didn’t have all the people 
there. That was another aspect of this. It appeared to me 
we had better sit down and get the data so that we could 
understand exactly what they were talking about and 
assess that data. 

And that is why I suggested that we go ahead and have 
a telecon within the center, so that we can review that.9* 


Dr. Keel, the Staff Director for the Rogers Commission, asked, 


Dr. KEEL. “So as early as after that first afternoon con- 
ference at 5:45, it appeared that Thiokol was basically 
saying delay. Is that right?" 

Dr. Lovincoop. "That is the way it came across to me. I 
don't know how other people perceive it, but that's the 
way it came across to me." 

Dr. KEEL. “Мг. Reinartz, how did you perceive it?" 

Mr. БКЕгмАВТ2. "I did not perceive it that way. I per- 
ceived that they were raising some questions and issues 
which required looking into by all the parties, but I did 
not perceive it as a recommendation to delay." 

Dr. KEEL. “Some prospect for delay?" 


93 Rogers Commission Report, Volume V, p. 919. 
ва Ibid., p. 923. 
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Mr. REINARTZ. “Yes, sir, that possibility is always 
there.” 

Dr. Кекі. "Did you convey that to Mr. Mulloy and Mr. 
Hardy before the 8:15 teleconference?” 

Mr. REINARTZ. "Yes I did. And as a matter of fact, we 
had a discussion. Mr. Mulloy was just out of communica- 
tion for about an hour, and then after that I got in contact 
with him, and we both had a short discussion relating to 
the general nature of the concerns with Dr. Lucas and Mr. 
Kingsbury at the motel before we both departed for the te- 
lecon that we had set up out at the Cape." 55 


At approximately 8:45 p.m. EST, the second phase of the telecon- 
ference commenced, Thiokol's charts and written data having аг- 
rived at the Kennedy Space Center by telefax. The charts present- 
ed a history of the O-ring erosion and blow-by in the Solid Rocket 
Booster joints of previous flights, presented the results of subscale 
testing at Thiokol and the results of static tests of Solid Rocket 
Motors. 

Mr. Boisjoly testified: 


I expressed deep concern about launching at low temper- 
ature. I presented Chart 2-1 with emphasis—now, 2-1, if 
you want to see it, I have it, but basically that was the 
chart that summarized the primary concerns, and that 
was the chart that I pulled right out of the [August 19] 
Washington presentation without changing one word of it 
because it was still applicable, and it addresses the highest 
concern of the field joint in both the ignition transient con- 
dition and the steady state condition, and it really sets 
down the rationale for why we were continuing to fly. Ba- 
sically, if erosion penetrates the primary O-ring seal, there 
is a higher probability of no secondary seal capability in 
the steady state condition. And I had two sub-bullets under 
that which stated bench testing showed O-ring not capable 
of maintaining contact with metal parts gap opening rate 
to maximum operating pressure. I had another bullet 
which stated bench testing showed capability to maintain 
O-ring contact during initial phase (O to 170 milliseconds 
of transient). That was my comfort basis of continuing to 
fly under normal circumstances, normal being within the 
data base we had. 

I emphasized, when I presented that chart about the 
changing of the timing function of the O-ring as it at- 
tempted to seal. I was concerned that we may go from that 
first beginning region into that intermediate region, from 
0 to 170 being the first region, and 170 to 330 being the 
intermediate region where we didn't have a high probabili- 
ty of sealing or seating.99 


55 Ты. 
66 Ibid. Volume ТУ, р. 790. 
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Mr. Boisjoly then presented Chart 2-2 with his added concerns 
related to the timing function. He mentioned in his testimony to 
the Rogers Commission: 


We would have low O-ring squeeze due to low tempera- 
ture which I calculated earlier in the day. We should have 
higher O-ring Shore hardness. . . . Now, that would be 
harder. And what that material really is, it would be lik- 
ened to trying to shove a brick into a crack versus a 
sponge. That is a good analogy for purposes of this discus- 
sion. I also mentioned that thicker grease, as a result of 
lower temperatures, would have higher viscosity. It 
wouldn’t be as slick and slippery as it would be at room 
temperature. And so it would be a little bit more difficult 
to move across it. 

We would have higher O-ring pressure actuation time, 
іп my opinion, and that is what I presented. . . . These 
are the sum and substance of what I just presented. If 
action time increases, then the threshold of secondary seal 
pressurization capability is approached. That was my fear. 
If the threshold is reached, then secondary seal may not be 
capable of being pressurized, and that was the bottom line 
of everything that had been presented up to that point.9? 


Asked by Chairman Rogers, “Did anybody take issue with you?." 
Mr. Boisjoly responded: 


Well, I am coming to that. I also showed a chart of the 
joint with an exaggerated cross section to show the seal 
lifted off, which has been shown to everybody. I was asked, 
yes, at that point in time I was asked to quantify my con- 
cerns, and I said I couldn't. I couldn't quantify it. I had no 
data to quantify it, but I did say I knew that it was away 
from goodness in the current data base. Someone on the 
net commented that we had soot blow-by on SRM-22 
[Flight 61-A, October, 1985] which was launched at 75 de- 
grees, I don't remember who made the comment, but that 
is where the first comment came in about the disparity be- 
tween my conclusion and the observed data because SRM- 
22 had blow-by at essentially a room temperature launch. 

I then said that SRM-15 [Flight 51-C, January, 1985] 
had much more blow-by indication and that is was indeed 
telling use that lower temperature was a factor. This was 
supported by inspection of flown hardware by myself. I 
was asked again for data to support my claim, and 1 said I 
have none other than what is being presented, and I had 
been trying to get resilience data, Arnie [Thompson] and I 
both, since last October, and that statement was men- 
tioned on the net.9? 


This second phasse of the telecon on the evening of January 27 
concluded with statements from Robert Lund, Thiokol's Vice Presi- 
dent of Engineering. His conclusion at that time was that the Shut- 


67 Ibid., р. 791. 
вв Тыа. 
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tle should not fly outside Thiokol’s database; that, is, that {Һе О- 
ring seals should be above 53 degrees Fahrenheit before lift-off. 

NASA participants in the telecon were not pleased with these 
conclusions and recommendations, according to Mr. Boisjoly and 
Mr. McDonald. Mr. Hardy, when asked what he thought about 
Thiokol’s recommendation, was quoted to the effect that he was 
“appalled” at Mr. Lund’s decision.®® 

Boisjoly also testified that Mr. Hardy said, ‘‘No, not if the con- 
tractor recommended not launching, he would not go against the 
contractor and launch.’’7° 

Shortly thereafter, Mr. Joseph Kilminster, Thiokol’s Vice Presi- 
dent for Space Booster Programs, was asked by NASA if he would 
launch and “he said no because the engineering recommendation 
was not to launch.’’7! 

Then, according, to Mr. Boisjoly, someone in Thiokol manage- 
ment asked for a five-minute caucus, and at that point Thiokol cut 
their speakerphone off. 


Chairman Rocers. “Mr. Boisjoly, at the time that you 
made the—that Thiokol made the recommendation not to 
launch, was that the unanimous recommendation as far as 
you knew?” 

Mr. Вол5јогу. “Yes. I have to make something clear. I 
have been distressed by the things that have been appear- 
ing in the paper and things that have been said in general, 
and there was never one positive, pro-launch statement 
ever made by anybody. There have been some feelings 
since then that folks have expressed that they would sup- 
port the decision, but there was not one positive statement 
for launch ever made in that room.’’?? 


Asked for his recollection of these incidents, Mr. McDonald com- 
mented, 


. And the bottom line was that the engineering 
people would not recommend a launch below 53 degrees F. 
The basis for that recommendation was primarily our con- 
cern with the launch that had occurred about a year earli- 
er, in January of 1985, I believe it was 51-С.73 


Mr. Mulloy testified: 


The bottom line of that, though, initially was that Thio- 
kol engineering, Bob Lund, who is the Vice President and 
Director of Engineering, who is here today, recommended 
that 51-L not be launched if the O-ring temperature pre- 
dicted at launch time would be lower than any previous 
launch, and that was 53 degrees. . . .?* 


At 10:30 p.m. EST, the teleconference between NASA and Thio- 
kol was recessed. The off-net caucus of Thiokol personnel lasted ap- 


$? [bid. 
то Ibid. 
та Тыа. 
72 Ibid. 
73 Ibid., Volume IV, р. 717. 
14 Ibid., Volume IV, p. 604. 
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proximately thirty minutes at the Wasatch office. Jerald Mason, 
Senior Vice President for Wasatch Operations, remembered that 
the conversation during the caucus centered around O-rings and 
the history of eroosion of the O-rings. Mr. Mason testified: 


Now, in the caucus we revisited all of our previous dis- 
cussions, and the important things that came out of that 
was, as we had recognized, we did have the possibility that 
the primary O-ring might be slower to move into the seat- 
ing position and that was our concern, and that is what we 
had focused on originally. . . . The fact that we couldn't 
show direct correlation with the O-ring temperature was 
discussed, but we still felt that there was some concern 
about it being сојдег.75 


Ten engineers participated in the caucus, along with Mr. Mason, 
Mr. Kilminster, Mr. Lund and Mr. C.G. Wiggins (Vice President 
and General Manager for Thiokol’s Space Division). Arnold Thomp- 
son 76 and Mr. Boisjoly voiced very strong objections to launch, and 
the suggestion in thieir testimony was that Lund was also reluc- 
tant to launch. 

Mr. Boisjoly, in testifying before the Rogers Commission, stated: 


Okay, the caucus was started by Mr. Mason stating that 
a management decision was necessary. Those of us who op- 
posed the launch continued to speak out, and I am specifi- 
cally speaking of Mr. Thompson and myself because in my 
recollection he and I were the only ones that vigorously 
continued to oppose the launch. And we were attempting 
to go back and rereview and try to make clear what we 
were trying to get across, and we couldn’t understand why 
it was going to be reversed. So we spoke out and tried to 
explain once again the effects of low temperature. Arnie 
actually got up from his position which was down the 
table, and walked up the table and put a quarter pad down 
in front of the table, in front of management folks, and 
tried to sketch out once again what his concern was with 
the joint, and when he realized he wasn't getting through, 
he just stopped. 

I tried one more time with the photos. I grabbed the 
photos, and I went up and discussed the photos once again 
and tried to make the point that it was my opinion from 
actual observation that temperature was indeed a discrimi- 
nator and we should not ignore the physical evidence that 
we had observed. 

And again, I brought up the point that SRM-15 [Flight 
51-C, January, 1985] had a 110 degree arc of black grease 
while SRM-22 [Flight 61-A, October, 1985] had a relatively 
different amount, which was less and wasn't quite as 
black. I also stopped when it was apparent that I couldn't 
get anybody to listen.77 


75 [bid., p. 759. 
16 Supervisor of Structures Design, Thiokol. 
тт Rogers Commission Report, Volume IV, pp. 792-93. 
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Commissioner Walker asked, “At this point did anyone else 
speak up in favor of the launch?” Mr. Boisjoly replied: 


No, sir. No one said anything, in my recollection, nobody 
said a word. It was then being discussed amongst the man- 
agement folks. After Arnie and I had our last say, Mr. 
Mason said we have to make a management decision. He 
turned to Bub Lund and asked him to take off his engi- 
neering hat and put on his management hat. From this 
point on, management formulated the points to base their 
decision on. There was never one comment in favor, as I 
have said, of launching by any engineer or other nonman- 
agement person in the room before or after the caucus. I 
was not even asked to participate in giving any input to 
the final decision charts. 

I went back on the net with the final charts or final 
chart, which was the rationale for launching, and that was 
presented by Mr. Kilminster. It was hand written on a 
note pad, and he read from the notepad. I did not agree 
with some of the statements that were being made to sup- 
port the decision. I was never asked or polled, and it was 
clearly a management decision from that point. . . . 

I left the room feeling badly defeated, but I felt I really 
did all I could to stop the launch.?8 


In testimony before the Committee on June 18, 1986, concerning 
the caucus and the decision to overrule engineering recommenda- 
tions, Boisjoly said: 

When we went off the line and caucused—one of the 
first statements that was made was that we would have to 
make a management decision by management people. And 
we continued very strongly to oppose that and we argued 
as vigorously as we could argue, and when you look up 
into people’s eyes you know you have gone about as far as 
you сап go. 

And so both Mr. Thompson and I just plain frankly 
backed off. You had to be there and you had to see the 
looks and feel the experience that it didn’t really make 
any difference what further you were going to say, you 
were just not going to be Беага."? 


At approximately 11 p.m. EST, the Thiokol/NASA teleconference 
resumed, with Mr. Kilminster stating that they had reassessed the 
problem, that the temperature effects were a concern, but that the 
data were admittedly inconclusive. He read the rationale recom- 
mending launch and stated that to be Thiokol’s recommendation. 
Mr. Hardy of NASA requested that it be sent in writing by telefax 
both to Kennedy and to Marshall, and it was.®° 


тв [bid. 
19 Cmte Hgs, Transcript, June 18, 1986, p. 85. 
во Тһе Committee has learned that (apparently due to an error in duplicating the relevant 
chart) the copy of this telefax that was sent to the Rogers Commission did not contain the stand- 
ard caveat that was printed below the company logo on the original telefax. The caveat reads, 
"Information on this page was prepared to support an oral presentation and cannot be consid- 
ered complete without the oral discussion." At the Committee hearings on June 18, 1986, Mr. U. 
Continued 
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Having heard the debate апа this decision, Mr. Reinartz accepted 
the conclusion and ended the teleconference. He asked whether 
anyone had any further concerns. None were expressed. Commis- 
— then asked what steps he had taken after the decision was 
таде. 


Chairman Косев. “I guess the question that still lin- 
gers in my mind is, in the Navy we used to have an ex- 
pression about going by the book, and I gather you were 
going by the book. But doesn't the process require some 
judgment? Don't you have to use common sense? Wouldn't 
common sense require that you tell the decisionmakers 
about this serious problem that was different from any- 
thing in the past? 

Mr. REINARTzZ. "In looking at that one, Mr. Chairman, 
together with Mr. Mulloy when we looked at were there 
any launch commits, any Level II, as I perceived during 
the telecon, I got no disagreement concerning the Thiokol 
launch between any of the Level III elements, the contrac- 
tor, with Mr. McDonald there. I felt that the Thiokol and 
Marshall people had fully examined that concern, and that 
it had been satisfactorily dispositioned based upon the evi- 
dence and the data that was supplied to that decision proc- 
ess on that evening, from that material, and not extrane- 
ous to what else may have been going on within Thiokol 
that I had no knowledge of." 

Chairman КОСЕЕ5. “Okay. Thank you. I’m sorry for the 
long interruption." 

Mr. REINARTZ. “Based upon—and as we skipped over it 
is only a point to illustrate, Mr. Chairman, that in our dis- 
cussion about the parachute with KSC and Mr. Aldrich, 
was to indicate that there was a clear area there where we 
had a very direct responsibility to inform them of the situ- 
ation, which Mr. Mulloy did. And after a discussion of that 
issue, Mr. Aldrich concluded that the launch should pro- 
ceed in that nature. Based on the results of the meeting 
and the conclusions out of the meeting, Mr. Mulloy and I 
informed the Director of Marshall, Dr. Lucas, and the Di- 
rector of Science and Engineering, Mr. Kingsbury, on the 
28th of January—about 5:00—of the initial Thiokol con- 
cerns and engineering recommendations, the final Thiokol 
launch recommendation, that I felt had led to a successful 
resolution of this concern.” 

General Kutyna. “Could I interrupt for a minute? You 
informed Dr. Lucas. Не is not in the reporting chain?" 

Mr. REINARTz. “Мо, sir." 

General Kutyna. “If I could use an analogy, if you want 
to report a fire you don't go to the mayor. In his position 
as center director, Dr. Lucas was cut out of the reporting 
chain, much like a mayor. If it was important enough to 


Edwin Garrison, President of the Aerospace Group at Thiokol, testified that the caveat at the 
bottom of the paper in no мау“. . . insinuates. . . that the document doesn't mean what it 
says." (Cmte Hgs, Transcript, June 18, 1986, p. 43.) After further investigation of this deletion, 
the Committee has concluded that it was not significant. 
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report to him, why didn’t you go through the fire depart- 
ment and go up your decision chain?" 

Mr. REgmNARTZ. “That, General Kutyna, is a normal 
course of our operating mode within the center, that I 
keep Dr. Lucas informed of my activities, be they this type 
of thing or other." 

General Kutyna. “But you did that at 5 o'clock in the 
morning. That's kind of early. It would seem that's impor- 
tant. Why didn't you go up the chain?" 

Mr. REINARTZz. “Хо, sir. That is the time when we go in, 
basically go into the launch, and so it was not waking him 
up to tell him that information. It was when we go into 
the launch in the morning. Апа based upon my assess- 
ment of the situation as dispositioned that evening, for 
better or worse, I did not perceive and clear requirement 
for interaction with Level IL, as the concern was worked 
any dispositioned with full agreement among all reasona- 
ble parties as to that agreement." 

Chairman Rocers. “Did I understand what you just said, 
that you told Dr. Lucas that all the engineers at Thiokol 
were in accord? 

Mr. REINARTZ. “Мо, sir. What I told him was of the ini- 
tial Thiokol concerns that we had and the initial recom- 
mendation and the final Thiokol recommendation and the 
rationale associated with that recommendation, and the 
fact that we had the full support of the senior Marshall 
engineering 81 and, as George has testified, to the exten- 
siveness of the group of people we had involved in that te- 
lecon with the various disciplines, that those three ele- 
ments made up the final recommendation." 

Mr. Horz. “Mr. Reinartz, are you telling us that you in 
fact are the person who made the decision not to escalate 
this to a Level II item?" 

Mr. ВипчАВТ7. “That is correct, sir." 82 


According to NASA's Program Directive SFO-PD 710.5A, Mr. 
Reinartz may have been required to report the matter to the Asso- 
ciate Administrator for Space Flight. A portion of that directive 
reads as follows: 


Significant items occurring subsequent to the FRR will 
also be reported to the AA-SF. Actions that can be easily 
accomplished without safety, mission, or launch impact 
and do not violate flight vehicle or launch complex config- 
uration integrity or cause basic changes to launch commit 
criteria, flight rules, flight plan, or abort and alternate 
mission plans, need not be reported.?? 


Was this telecon, and the decision reached, "significant?" 
NASA's request that the Thiokol decision be put in writing indi- 


81 Staff review of teleconference materials used by Marshall engineers Wilbur Riehl (Chief, 
Nonmetallic Materíals Division) and John Miller (Technical Assistant to the SRM Manager) in- 
dicates that some of the Marshall engineering staff shared the concerns expressed by Thiokol 
engineers. 

82 Rogers Commission Report, Volume У, pp. 917-18. 

85 SFO-PD 710.53, р. 3. 
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cates that МЗЕС personnel felt the situation was significant, since 
in effect Thiokol was reconfirming the flight readiness of the SRM. 

It is also interesting to note, in light of the directive, that Mr. 
McDonald testified before the Commission to the effect that Mr. 
Mulloy had made some “fairly strong comments . . . about trying 
to institute new launch commit criteria." 84 

Mr. Mulloy responded to this by explaining what he had at- 
tempted to say. 


Mr. MuL oy. “The total context, I think, in which those 
words may have been used is, there are currently no 
Launch Commit Criteria for joint temperature. What you 
are proposing to do is to generate a new Launch Commit 
Criteria on the eve of launch, after we have successfully 
flown with the existing Launch Commit Criteria 24 previ- 
ous times. With this LCC, i.e., do not launch with a tem- 
perature greater than [sic] 53 degrees, we may not be able 
to launch until next April. We need to consider this care- 
fully before we jump to any conclusions. It is all in the 
context, again, with challenging your interpretation of the 
data, what does it mean and is it logical, is it truly logical 
— we really have a system that has to be 58 degrees to 

УЕ 

General Kutyna. “Mr. Mulloy, if іп fact the criteria 
were 53 degrees, it would have an impact not only on this 


launch, but on the shuttle program. . . . It is a fairly im- 
portant decision to say you can't launch below 53 degrees, 
isn't it? 


Mr. Момох. “Yes, sir, I agree with that. I cannot de- 
scribe the impacts, but, as I say, based upon our previous 
experience and our actions in flying subsequent vehicles 
after 51C, I found that to be a surprising conclusion. . . ." 

Mr. Sutrer. “. . . [Instead of saying you have to wait 
until next April to launch, the thing that you do is you go 
and there were three different levels of improvements that 
were discussed. The thing to do then was to put those im- 
provements in the program, not infer that these engineers 
are saying, we’re throwing a ringer at you that says don’t 
launch until next April. I think that is putting those engi- 
neers into a little bit of a hot seat. And if they’re trying to 
do their job and say, hey, we ought to do something about 
this, there ought to have been more attention paid.” 85 


The Rogers Commission report included the statement, “Ї is 
clear that crucial information about the O-ring damage in prior 
flights and about the Thiokol engineers’ arguments with the NASA 
telecon participants never reached Jesse Moore or Arnold Aldrich, 
the Level I and II program officials, or J. A. Thomas, the Launch 
Director for 51-L." 86 

Based on the available evidence, the Committee is unable to con- 
clude whether or not Mr. Moore or Mr. Aldrich, with the informa- 


84 Rogers Commission Report, Volume IV. p. 721. 
85 Ibid., Volume V. рр. 843-45. 
86 Thid., Volume I, p. 101. 
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tion available to them that day, would have reached а decision to 
stop the launch had they been informed of this meeting. It does 
appear, however, that a three-hour telecon, in which arguments 
are raised about launch commit criteria and the contractor is 
asked to reconfirm the flight readiness of his hardware fall under 
the definition of the policy directive. At the very least, the STS 
Program Manager should have been presented the new declaration 
of flight readiness with an explanation of why it had been devel- 
oped. This should have been a necessary addition to the Certificate 
of Flight Readiness prepared after the Flight Readiness Review. 

The Committee also reviewed tapes and transcripts of conversa- 
tions that took place in the Firing Room on January 28th involving 
discussions of the threat posed by ice on the Fixed Service Struc- 
ture. Kennedy Space Center managers, in response to the predicted 
low temperatures that would be seen in the hours before the 
launch of STS-51L, took action to protect Launch Complex 39B and 
the Shuttle from freezing and ice buildup. This involved imple- 
menting the “freeze protection plan” for launch pad facilities. Ac- 
cording to a post-accident report: 


Two actions within the PLAN were intended to limit the 
ICE DEBRIS which potentially could cause damage to the 
Shuttle Vehicle during launch. The first action involved 
adding approximately fourteen hundred gallons of anti- 
freeze into the overpressure water troughs. The water 
troughs in both SRB exhaust holes have a total capacity of 
6,580 gallons. The resultant antifreeze to water ratio was 
calculated to be 21.3%. According to the manufacturer's 
specifications, solution protected against freezing down to 
an ambient temperature of 16 degrees F. The second 
action involved the draining, where practical, of all water 
Systems. Several systems, such as Firex [fire extinguish- 
ing], Deluge, and emergency shower and eyewash, were 
not drained. These systems were opened slightly and al- 
lowed to trickle into drains. The trickling water was found 
to cause drain overflows. High wind gusts then spread the 
water over large areas and it then froze.?7 


Soon after the call-to-stations on 28 January, at approximately 
midnight, cameras on the pad allowed engineers in the Firing 
Room to see that the gantry was heavily encrusted with ice. Over 
the Engineering Support Room communications loops, the follow- 
ing conversation took place: 88 


87 NASA, Kennedy Space Center, “STS-33 (51-L) Ice/Frost Team Evaluation Report: ESS/ 
RSS/MLP Deck/Pad Apron Icing,” January 30, 1986, P 1. 

88 Conversations were recorded from the Kennedy Space Center Operational Intercommunica- 
tion System (OIS), which permits members of the launch crew to discuss problems that occur 
during the countdown, and permits them to contact various mission support facilities around 
the country. The transcripts provided to the Committee do not indicate the exact times at which 
the referenced conversations occurred, and so the flow of conversations has been reconstructed 
in an attempt to provide logical consistency. ‚ | 

Most of the transcripts іп this section are drawn from OIS Channel 245, identified as the со- 
ordination channel for JSC/MSFC/KSC Engineering personnel in the Engineering Support Area 
at Kennedy Space Center. Conversations among Rockwell Internationa! personnel were obtained 
from OIS Channel 216, described as the coordination channel for JSC personnel at Johnson and 
Kennedy centers and Rockwell engineers in Downey, California. Transcript page numbers аге 
those supplied by NASA. 
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BL. This is Bob оп 245. 

Drrector. Go ahead, Bob. 

BL. Did you ever find out any more about that water? 

DIRECTOR. Мо, no І haven't. 89 

BL. Okay, I guess the thing, they don’t know yet where that water’s coming from 
and the NTD’s [NASA Test Director] got some folks looking into it. I guess the thing 
you guys need to do is see if you can get certain cameras to look at the vehicle and 
to — if there’s any water getting оп the vehicle that might freeze and cause 
problems. 

DIRECTOR. I think what we need to do, Bob, we need to decide do we feel comforta- 
ble enough to let it keep running and forming ice up there, or we ought to stop and 
send somebody in there and try to shut it off. 

BL. Yeah, okay. 

DIRECTOR. Do you guys think we could form enough ice there to cause us any 
problem on liftoff or anything? 

BL. I think you've already done that, Horace. 

E sadi Well, then, we ought to stop and go out there and get the water shut 
off. 

s Yeah, we're worried about an icicle up high—well, see, camera 108's on the 
155 foot. ... 

ITL. 155? Yeah. So you're already getting high up, you know. And if the wind's 
going to be out of the north-northwest. . . . 

Director. All right, let's stop them and send the people out there and see if they 
can shut the water off. 

ITL. I think what it is, is the fire hose—if you look right over, if you go to 108 and 
go like you're going to the elevator, you'll see a fire hose, looks like a fire hose 
draped across there... 

Director. Yeah. 

ITL. . . . And I think they take the fire hose and carry it over to the shower, the 
eye shower. And evidently the drains that they’re draining into is frozen off, or 
either the hose has fallen off the drain, one or the other. 

DIRECTOR. Okay, we gotta work this іп. We're going to tell them to go out there 
and shut the water off. 

ТТТ. Okay.?? 


The ice/frost team was dispatched to the pad and arrived at ap- 
proximately 1:45 a.m. What they found during their inspection of 
the Fixed Service Structure was not very encouraging to the team 
leader. He reported back to the Firing Room: 


ITL. Horace, this is Charlie on 245. 

BL. Hello, this is Bob. I think he may still be in that HIM (Hardware Interface 
Module] meeting (оп the fire detector problem]. What do you see out there? 

ITL. Okay, starting on about the 235 foot level where the top hose is, the fire hose 
that was draining into the shower, the hose is not really, the drain is in the shower, 
the hose is not really draining into the little bowl on the shower and it was spilling 
over. So we have a lot of hard solid ice from the 235 feet down to 195 feet where 1 
am now. Most of it's on the west side and the north side, and about halfway in- 
between, the floor is one solid sheet of ice about an inch and a half thick. And down 
on 195 foot level, the water's on the pipe and plumbing and structure and beams all 
the way over to the Orbiter Access Arm [ОАА]. That's as far down as we got so far. 

BL. Copy. 

ITL. We have some icicles about 18 inches long.?! 


The Ice Team leader later reported that ice was covering part of 
the floor on the 195 foot platform where the crew would enter the 
Orbiter. Part of this discussion follows: 


Significant participants in these conversations include: 

DIRECTOR: Director of Engineering, Kennedy Space Center. 

BL: Chief, Mechanical Systems Division, Shuttle Engineering Directorate. 
LD: Launch Director, STS 51-L. 

ITL: Ice Team Leader. 

89 OIS Channel 245, p. 570. 

20 Thid., рр. 570-72. 

91 Ibid., р. 573. 
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BL. Charlie, is that ке going to be any kind of impediment to the crew? 

ITL. Uh, not to the crew. I don’t see any out here where the crew walks. 

BL. How 'bout to the baskets [the emergency escape system]? 

ITL. . . . Up to the what? 

BL. If they had to go to the baskets for any reason, do they have a clear path 
through that ice? 

ITL. Oh, no. When you get over that way, we got ice. 

BL. So they had to get out in a hurry in order to get to the baskets, they've got to 
go over a sheet of ice. 

ITL. Oh, yeah. On the north side, that's all one hard sheet of ice. Now, they could 
get to the two baskets on the south side, probably three baskets on the south side. 
Hold on just a minute, РН go take a look. . . .?? 

ITL.Okay, Bob, I'm back. 

BL. Okay. What's it look like over there? 

ITL. Okay—some right at the elevator, right where the camera is, going back 
toward the baskets, we got ice on the floor. And the ice goes all the way across the 
west side of the facility, all the way over to the north corner on the floor. So it is 
slippery. Once you get past the west-most part of the FSS, the ice on the floor 
ceases, and you got a clear walkway, so al] five baskets are, uh, six baskets do have 
a clear walkway right around the baskets. But to get between the elevator and the 
camera where you're looking at, there's some ice on the floor. 

BL. Okay. 

ITL. And including the handrails that they would be holding on to. But out here 
from the Orbiter Access Arm over to the camera is clear. 

BL. What's your Safety guy there think about that? You got a Safety guy with 
you, don't you? 

ITL. Yes, he's concerned. Matter of fact, there's some ice right under my feet now 
that I look. 

BL. Charlie, Horace is back with us now. Why don't you start up your review 
from the 235 foot level on down again. 

ITL. Okay. From the 235 foot level is where we had these litle Firex systems—the 
hose, the rubber hose which we ran over to the shower back on the northwest 
corner of the FSS, so we ran it on to the eyewash shower the level below, the 235 
foot level, and it was running out of the drain, you know, the little basin—it was 
overflowing the little basin. So we have over in that area, down to the 195 foot level 
on the north side of the FSS, icicles that are about 18 inches or so long, about one 
inch in diameter or more at their maximum diameter. This floor, the grating, over 
on the north side paralleling the showerway and the elevator in some places are 
frozen solid about two inches thick. You know, the area is like 10 [by] 10 or more. 

Direcror. On the floor, which floors, Charlie? 

ITL: The floor of the grating, on like the 215 and there's a level between 215 and 
right under, between 215 and 195; there's a half-level that you go out to the hatch 
on the north side. 

Director. Okay. 

ITL. And there's a lot of icicles hanging, you know, under the floor. As far as the 
east side goes, on the 195 foot level where we are now, we have about one-quarter 
inch or one-half inch ice. On the beam structures themselves, they go all the way 
over to the—right at the hinge where the Orbiter Access Атта goes out. I don't see 
any on the Orbiter Access Arm itself, but there is some here where I’m standing 
and a little bit on the floor. Just before you came on, we were talking about the 
slidewire—the baskets. The floor from the Orbiter Access Arm over to, back where 
the camera is, is fairly clean. And from the camera back to the west side, is some 
ice on the floor to the west edge of the FSS. 

DIRECTOR. Okay. 

ITL. So the crew would have to walk across one slick spot. Around the baskets 
themselves, it's fairly clean. But to the northwest corner of the FSS where the bas- 
kets are, there's heavy concentration of ice on the floor.?? 


The discussion concluded: 


Director. Do you see anything out there that makes it unsafe for the crew? 

ITL. At this time, I'd say from the elevator to the Orbiter Access Arm would be 
fairly good; the floor's in good shape. The elevator's got a little bit of—the doors are 
real hard to work but everything seems to work in that neighborhood. If they had to 


өг Ibid., p. 574. 
эз Ibid, pp. 574-76. 
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go to the slidewire, it'd be very slippery from the camera that you're looking at to 
the slidewire itself. There’s an area about ten feet long where the handrails have ice 
on them, as well as the floor.?* 


This discussion is of concern to the Committee. The slidewire re- 
ferred to is the means by which the Shuttle crew would evacuate 
the launch pad if an emergency were to occur that required a rapid 
exit from the pad area. Crew safety concerns should dictate that 
the ice situation described by the Ice Team leader is unacceptable, 
and that some effort to remove the ice from the floor and handrails 
should be made. There is no indication that this was done. If the 
ice could not be removed, the mission should have been delayed 
until the danger represented by the ice could be eliminated. 

This situation, admittedly, had nothing to do with the accident 
that destroyed STS-51-L. However, had this been the one time that 
use of the pad escape system was required, the crew would very 
likely have been impeded in their attempt to reach the escape bas- 
kets, and the lost time might have proven fatal. This system must 
be operated with the expectation that it will be used, and the 
countdown procedure should require that no barriers to its use be 
present before launch. 

As the Ice Team continued its inspection, the discussion in the 
Firing Room involved the possible threat posed by the ice problem. 

BL. We're just going to ask your opinion on the debris concern. If Charlie thinks 
we have a concern with debris, and I guess I would find it hard to believe that we'd 
be concerned about it from the FSS, but if we do have a concern, can we go out 
there and try to clean it up a little bit? 

Director. Yeah, I think we could. I think when he gets through here, if we think 
there's some areas that we need to clean up a little bit, we probably could. 

BL. I think Safety would probably have to make a call, myself, on the floor if they 
think it's, that's a concern, but. . . . 

DıRECTOR. Okay, he's [ITL] оп 108 now. 

BL. I see him on camera 108, next to the 155 foot level. 

LD. Hey, what kind of debris are you guys talking about? 

BL. The icicles on the FSS. 

LD. Yeah, and how is that going to hurt you? 

BL. Weil, that's what I'm saying. I don't think it—personally, I don't think it 
would, but I just wanted to... . 

Director. [garbled] by there, you're not gonna hit the Orbiter, but Charlie's wor- 
ried about it, Gene—the acoustics releasing it and it being free when the Orbiter 
comes by. 

LD. Boy, he's really stretching it. 

Director. Oh no, I don't know whether that's stretching it too much or not. 

LD. Well, I mean if we can ignore it, we need to feel comfortable about it. 

P. All right, Gene, remember the wind is coming from the northwest. 

LD. We need to all know if we don't get back into tanking as soon as possible, we 
could possibly blow it just for that. 

DIRECTOR. Yeah, we understand, Gene... . 


The Ice Team leader’s next report was no more encouraging. 
Water had spilled over the platform as the drains were unable to 
cope with the volume of water they were asked to manage. Icicles 
were found on the platform handrails that could easily be knocked 
off.96 


95 


94 Thid., р. 576. 
25 [bid., рр. 577-78. 
96 [bid., p. 578. 
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As the team leader was explaining that the water could not be 
completely cut off for fear of making the situation worse.?* the fol- 
lowing conversations occurred: 


LD: Hey, we gotta come out of there when you guys telling us you’re pretty sure 
that water system’s gonna work. 

Director. Yeah, you feel comfortable with what you see out there, Charlie, now? 

ITL. We have a lot of ice, if that’s what you mean. I don’t feel comfortable with 
what’s on the FSS. 

DIRECTOR. Then what choices we got? 

ITL. Well, Га say that only choice you got today is not to go. We’re just taking a 
chance of hitting the vehicle. 

LD. You see that much ice? 

ITL. Well, the problem we have is we hve a lot of icicles hanging, you know, even 
on the west side of the FSS here, which is only 60 feet or more from the Orbiter 
wing. And I’m sure that stuff is going to fall off as soon as the acoustics get to it. 
And you got a northwest wind, so you know, somebody will have to make that as- 
sessment. If we’re worried about that little bit of ice that comes off the hydrogen 
vent arm, and the GOX [gaseous oxygen] vent arm, what we have over here is con- 
siderably more than that, you know—it’s a hundred-fold. 

DIRECTOR. You got enough ice that's over there that’s big enough and got enough 
density to it that if it hits the Orbiter it could do some significant damage? 

ITL. Yes, we до. .. . It’s оп the east side of the FSS. On the northeast corner of 
the FSS, which puts you about 65 feet or so from the vehicle. But it comes right to 
about where this camera is, it’s right on the center thin line of the FSS, it comes 
that far over. 

BL. Charlie, I would doubt the wind could blow that over. Are you concerned 
about during—after engine start, that things should kinda blow around? 

ITL. Uh, yes. And the problem is it’s so high, too. You know, it’s way up to the 
— E it were all the way down here to the bottom, it probably wouldn't be any 
problem. 

BL. Can we go along the east side handrails and knock it off now? Isn't that the 
biggest concern—the east side? 

ITL. Well, it's on the handrails and its on the floor underneath, too. You know, I 
guess it could probably be done but it'd be a job. 

BL. It would take a long time, wouldn't it? 

ITL. All the FACS pipes, and all the conduit and all the cable trays and then 
hanging down underneath the floor, you know, everywhere, on all the pieces of grat- 
ing, you got little icicles hanging down. 

DIRECTOR. Who do you have out there with you? 

ITL. B.K., as far as my group goes. 

Director. Okay, why don't you guys go ahead and walk everything down and 
quick as you get—come on back, let's get with Gene and we'li sit down and talk 
about what we got.?8 

LD. Okay, why don't you do like Horace said, come on back and we'll go ahead 
and tank and we'll have you look at it when you go back. 

ITL. Okay, and I think—you know, the Rockwell people have a program which 
says it probably would be all right, so contact them and let them put it in the ma- 
chine and see what they get.?? 


As the Ice Team returned from its initial inspection, the launch 
director spoke to KSC's Director of Engineering about the ice situa- 
tion: 

LD. Yeah, we really need to do some head scratching on this ice thing and what 
we gonna do once we get back in. We've just about used all our hold. 

Director: Okay. | 

LD. What we're gonna do—we’re not gonna opt to have a hold, we'll let the ice 
team go in just like normal, but we gonna keep counting the clock, and if we have 
to get ourselves into eating some of our launch window, we'll do it late. 

DIRECTOR. Okay. We can do the ice inspection parallel with counting. 

LD. Okay, but we need to have Rockwell in there where we need to ready to talk. 

Director. We can get Don in and we'll do that. 


эт bid. 
98 [bid. pp. 579-81. 
99 Ibid., pp. 581-82. 
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LD. I don’t see how in the world—we need to worry about that ice. I don’t know 
what’s going to knock it off. It’s going to freeze and stay there. 

Director: І don't think it will hit the Orbiter, Gene. It'll probably come off just 
from the acoustics, but. ... 

LD. Yeah, as you go by, I would think . . . I would think after we start the en- 
gines, if it starts breaking loose then, I don't know how it would travel that far 
until, you know, the six seconds or so we are on the ground. 

DIRECTOR. Yeah. We'll get everybody here; we'll talking before—while we're tank- 
ing before they go out, then we'll be ready to help make an assessment.!99 


The Ice/Frost Team returned to the launch pad during the 
scheduled countdown hold at T-3 hours. The crew was somewhat 
larger than usual, since their primary objective was to clear ice 
from the water troughs on the launch pad. The team would also be 
making a follow-up assessment of ice on the FSS. 

According to the post-accident report, "the team arrived at Pad 
B at 0654 hours and departed at 0844." A summary of their activity 
during this time stated: 


Ice in the troughs had thickened and was found to be 
solid. All secondary troughs except the northern most one 
in each hole now had ice. The two inboard primary hole 
troughs were also forming ice. . . . The "shrimp net" was 
employed to break up the ice and remove it. Approximate- 
ly 95% of the ice was removed. The ice and unfrozen anti- 
freeze solution was measured using an infra-red pyrometer 
and found to have a temperature between 8 and 10°F... . 
The pyrometer measured the MLP deck surface tempera- 
ture as 12°F. On the FSS the quantity of ice had increased 
but the overall extent of icing was generally the same. In 
most cases, sheet ice was firmly adhered to the structure. 
Icicles could very easily be "snapped" off. Water continued 
to trickle down the facility—including the RSS [Rotating 
Service Structure].1°! 


NASA launch team members were continuing their debate over 
the risk represented by the ice at this time. 


LD. What do you think about the ice now? 

Director. Well, I don't know, Gene. I keep thinking there is an answer if we сап 
find it, but we got people out talking it and I think we can make a decision on the 
SRB things [troughs]. I think we have the data there that we can make the right 
decision on that. The tower is what's going to be the one that is going to be hard to 
come to a decision on. 

LD: But do we have any data that shows a mechanism for moving that ice across 
there? 

Director. That's what we're trying to see if we can come up with some kind of 
rationale why it won't. Charlie says we've got some data that we have moved some 
pieces across from basically the tower to the vehicle but we're—[Marty Ciofoletti, 
Vice President for Space Transportation System Integration, Rockwell Internation- 
al] and the guys are working with Downey to see how they feel if they come up with 
anything on the acoustics and things like that. 

LD. Okay.!?? . 

KSC’s Engineering Director then called the Rockwell liaison.!9?* 


100 Thid., pp. 583-84. 
101 "[ce/Frost Team Evaluation Report," p. 4. 
102 OIS Channel 245, р. 595. 
1028 Rockwell personnel appearing in House transcripts are identified as follows: 
RI: Kennedy Space Center liaison. 
ЕТІ: Director of Technical Integration. 
Continued 
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Откестов. John, оп 245. 

RI. Go ahead, Horace. 

DIRECTOR. You guys still talking to Downey? 

RI. Yeah, we haven't go anything new since I last talked to you. Larry Williams 
just called in. He wants to talk to Bill Hovath [?] so they are getting ready to make 
a call to his now. 

DIRECTOR. Okay. 

RI. But we haven't got anybody. You know Jack McTimmons (McClymonds]—1 
talked to him and all he had to offer was his old program data of how far ice would 
go at various wind speeds, you know, from the FSS that's not our primary concern, 
obviously, right now. 

Пінестов. No, that's right.!9? 


In the Mission Support Room in Downey, California, Rockwell 
support personnel were expressing the same concerns as the Ice 
Team Leader, and were not confident their computer model could 
remove the uncertainty presented by the ice. Rockwell's Kennedy 
Space Center liaison was asked for information. 


кор: MSR [Mission Support Room] 
. Go. 

RTI. Good morning, John. ОБ... 

RI. It's been a busy morning! 

RTI. I bet—looks bad, eh? 

RI. Ice does look bad, yeah. The situation we've got right now is that they're 
working the bags in the ЗЕВ hole; they reported slush in those bags and we were 
watching on TV and some of that slush was pretty big and pretty heavy. But I think 
we can take саге of that part—I think they re gonna get that cleared up. There's а 
crew out there working on those right now. One of the concerns [Richard] Colonna 
[Orbiter Project Manager, JSC] had was reflected pressure wave problems if there 
was a film of ice across those bags, but it looks like they’re breaking that up. The 
big concern is gonna be the mass of ice that is on the FSS, from the 235 foot level 
all the way down to the MLP [mobile launcher platform]. кеу platform had had 
water running on it all night and they’re just a—some of the closeups of the stair- 
wells looks like, uh, something out of Dr. Zhivago. There’s sheets of icicles hanging 
everywhere. We've had reports, back on the northwest corner, of ice, icicles—this із 
a couple hours ago, the crew are up there walking it down right now, so we'll prob- 
ably get some updates here shortly—but the initial walkdown said icicles up to two 
feet long by an inch in diameter. On the northwest corner, kind of graduating down 
to about three inches by one-quarter inch diameter on the east side, with periodic 
one-foot icicles on the east side on some of the cross beams. 

RTI. Sounds grim. 

RI. The big concern is that nobody knows what the hell is going to happen when 
that thing lights off and all that ice gets shook loose and come tumbling down and— 
what does it do then? Does it ricochet, does it get into some turbulent condition that 
throws it against the vehicle? Our general input to date has been basically that 
there's vehicle jeopardy that we've not prepared to sign up to. . . . 

RTI. Okay. We didn't see this when we had icing conditions before? 

RI. No, and they didn't run the showers all damn night before. They ran the 
showers this time and ran'em, pretty heavily by the look of it, the drains froze up 
and they all overflowed. 

RTI. Oh. wm 

RI. And I guess nobody watched it all night or, if they did, they didn't say any- 
thing. But, uh—is John [Peller, Rockwell Vice President for Engineering] in yet? 

RTI. No. 

RI. Okay. We need to—you know, somebody at his level needs to get in and try to 
get up to speed as fast as they can. Тћеу ге p to be looking for a final position 
from Rockwell here very shortly. We got—Bill Frohoff is right now talking to Larry 
Williams of JSC. Гуе got Colonna and Bobola sitting here with Al Martin and 
myself and we’re probably going to be the forcing factor on this decision. Until 


RSD: Site Director for Launch Support Operations. 

RTP: Thermal] Protection Project Manager. 

RDE: Vice-President for Engineering. 

RVP: Vice President and Program Manager for Orbiter Operations Support. 
RSR: Senior e rh Mission Evaluation Room, Johnson Space Center. 
103 Ibid., pp. 596-97. 
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somebody can come up and tell us that the potential flow path is to the objects on 
the FSS at liftoff—you know, we're going to have to assume the worst case—but I 
don’t think anybody is going to have that sort of data. 

RTI. This is going to be a tough опе. 104 


The Ice Team Leader reported that efforts to clear out the water 
troughs under the SRBs were meeting with success, and that the 
team was managing to clear the ice that had formed on the left 
SRB aft skirt.!95 

As this occurred, Rockwell’s Site Director for Launch Support 
Operations was reporting from KSC to Downey. He said, 


RSD. ... [T]he situation here is that—very quickly—when Charlie gives his 
report, then they are gonna want to reconvene a top level management meeting 
here, so whatever we want to say in that meeting we’re gonna have to come up with 
it here and now in order to be ready to say it and I guess the situation is that there 
are icicles all over the stand, that’s the fixed service structure, all up and down it, 
various levels—some of the icicles are two feet long, an inch or two at the base, 
there are lots of small icicles hanging all over the place. What they say is that when 
they touch them gently that they break off and for that reason I don’t think there is 
any doubt about the fact in my mind that when we start the SSMEs a lot of these 
icicles are going to break off and they’re going to—and when they do break off, then 
what’s going to happen is that they’re gonna come tumbling down, they can ricochet 
218 of the service structure and they can—then some ої them wind ир on top of the 

Р 106 


The discussion was interrupted at this point by another report 
from the ice team, indicating that the lower levels of the FSS had 
ice coverage equal to the levels already discussed. The decision was 
made to bring the team leader back for a report to managers, in 
order to decide whether the threat was sufficient to stop the 
launch. 197 

The discussion at Rockwell then resumed: 


RSD: Okay. He was just reporting on one of the levels. As he, as Charlie Steven- 
son, of NASA, moves up and down with the ice team, they’re reporting on each level 
and on that particular level he was reporting a signficant amount of ice as the 
result of the overflow from the shower. You know, they left the water running in 
order to keep the pipes from freezing and then, I guess, some of the drains have 
frozen so then the water’s overflowing and that’s what’s creating a lot of the big 
icicles. But at any rate, what I was getting around to, it just appears to me that 
when these icicles break off when they start the SSMEs some of them are very 
likely—in fact, РИ tell you, almost for sure—are gonna wind up on бор of the МІР 
and then when we launch it seems to me it would be very difficult for anybody to 
predict where that debris would go and it appears to me that there would be a possi- 
bility of some of that debris impacting the Orbiter tiles and I don’t know how our 
aerodynamists or analysts or anybody you know could really say that that wouldn’t 
happen. They can predict what happens when you drop a piece of ice in the wind. 
They can also predict what happens due to aspiration when you start the Solid 
Rocket Motors and SSMEs. The real question is how do you predict what happens to 
ice chunks that are on top of the MLP at launch and where they go. So, at any rate, 
that’s how we see it here at launch. 

RTI. Well, one thing I guess we can see, from the view that we have, is ice on top 
of the MLP right now. 

RSD. Yes, there is ice on top of the MLP right now. 

RTI. That's unacceptable. Anything in the trough is unaccepatable and any ice 
that would impact the vehicle during ascent is unacceptable and we can't predict 
what's going to happen to all that massive ice on the towers, so I think we're in a 
critical situation. . 


104 015 Channe! 216, pp. 340-41. 
195 OIS Channel 245, pp. 600-601. 
106 OJS Channel 216, р. 345. 
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RTP. Most ої the ice on the tower is going to end up оп ап МЕР, probably right 
before SRB ignition anyway—right, Al? You think? 

RTI. Well, it’s going to end up looking like snow, though, isn’t it? 

RTP. No, this is hard ice. 

RTI. Once it hits that tower it’s not going to be hard ice. What we’re worried 
about is the aspiration effects of the motion of the ice into the vehicle. 

RTP. You're still going to have large chunks of ice, ice cubes. Like an ice cube. 

RTI. That's unacc . . . question is, how high is, is the highest elevation of ice, 
what was the. .. . 

RTP. I think they’re saying it’s all the way to the top of the tower, like the 235 
foot level has icicles forming and all the way down from there. 

RTI. Okay. 

RSD. Bob, would you say again what you were saying about the ice on the tower 
and the concern about that? 

RTI. We really don’t have a data base to know what’s going to happen to the ice. 
We do have some information that we can get horizontal movement of the ice into 
the vehicle. Obviously, since it’s very tenuous, it’s going to be bouncing all over the 
place. It’ll be bouncing off the J-boxes and everything else. So you’re going to have 
some horizontal velocity of ice. 

RTP. Hey, Bob, you’re breaking up again. 

RTI. Okay. Let me try once more. Our data base does not allow us to scientifically 
tell you what’s going to happen to the ice. Therefore, we feel we’re in a no-go situa- 
tion right now. 

RSD. Okay. That, Bob, is a consensus down here, too—that there’s no way, that is 
for Rockwell, the consensus down here for Bill Frohoff and ourselves, that there’s 
no way to predict what’s going to happen, and I think that when we get into this 
next meeting, we need to state that as Rockwell’s position and I think that’s going 
to come up fairly soon, here. Now, I have told Dick Colonna that I suspect that’s 
going to be the Rockwell position, I haven’t told them officially. I’ve also told 
Horace that, but I haven’t told him that officially, and I guess, or, uh, do you think 
we're ready now to, uh, for Rockwell to state that position and do you want to go 
back to the MER with that or how do you want to handle it? 

RTI. Well, what I would like to do is get ahold of [Bob] Glaysher—we're not sup- 
posed to overrule him—and talk to him about it. Is he there? 

RSD. We woke him up at 4:00 this morning. He called in about an hour ago. We 
understood he was on the way and he's not here yet. 

RTI. Okay, I'd like to stonewall it until he gets here.!98 


At about this time, Mr. Bill Fleming, the senior representative of 
Rockwell International, reported from the Mission Evaluation 
Room at JSC that “ice оп МІР, tower and trough not acceptable to 
MSR [Rockwell's Downey facility]." 109 

Just prior to attending the meeting called by Arnold Aldrich, the 
Vice President and Program Manager for Orbiter Operations Sup- 
port at Rockwell held the following teleconference with their Chief 
Engineer at Downey. 


RDE. Hey, we've gone over this again. Colonna called me and wanted to see if 
there is a way we could give it a go. But, when all the experts have looked at it, we 
still have concerns with three mechanisms. One, direct transport of falling ice into 
the vehicle at SSME ignition and the wind is adequate to make that happen. The 
ten-knot wind can move it laterally like twenty feet and a fifteen-knot gust could 
take it laterally forty feet. So even though you might be able to placard it, it's very 
close with the wind you've got. Secondly, you've got a rebound mechanism, where 
ice falls down into the lower part of the platform and goes out. Some pretty sizeable 
chunks and sometimes all it does is break an icicle in two, that's clearly enough to 
cause significant tile damage. And, finally. the ice ends up on the MLP and in the 
trough is all potential debris sources at SRB ignition and liftoff and the trajectory 
those things take are highly unpredictable and we just note in films tended to go in 
different directions. So we аге пої in the position to, uh. . . . So we've been through 
the three mechanisms, none of which we can completely clear. Dr. Petrone's here; 
we've discussed it with him. We still are of the position that it's still a bit of Rus- 


108 QIS Channel 216, pp. 345-48. 
199 NASA, Johnson Space Flight Center, "Presidential Commission Action Item (A-301) Re- 
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sian roulette; you'll probably make it. Five out of six times you do playing Russian 
roulette. But, there's a lot of debris. They could hit direct, they could be kicked up 
later by the SRBs, and we just don't know how to clear that. 

RVP. Okay. Our position fundamentally hasn't changed. We'll just go in now, we 
got a 9:00, we'll go in and express it. I'll let you know what happens. 

RDE. And obviously, uh, you know, it's their vehicle and they can take the risk, 
but our position is as stated. 

БУР. Okay, you got 1.110 


No recording exists of the meeting at 9:00 a.m. on January 28. In 
testimony before the Commission, Mr. Robert Glaysher stated that 
he told Mr. Aldrich that "Rockwell cannot assure that it is safe to 
fly." 111 

Mr. Al Martin testified that: 


I also added that we do not have the data base from 
which to draw any conclusions for this particular situation 
with the icicles on the tower, and also, we had no real ana- 
lytical techniques to predict where the icicles might go at 
lift-off. The other thing that I did was review the fact that 
prior to each launch there is great care taken to assure 
that there is no debris out on the launch pad. A day or two 
before launch a crew goes out and they walk down the 
entire tower and walk down the mobile launcher surface, 
and also the concrete apron around the launch pad for the 
purpose of removing any debris such as nuts, bolts, rocks 
or anything else that might be there. . . . So I was drawing 
a corollary between the care that is normally taken for 
debris and painting a picture that the icicles appeared to 
me to be in that same category.!!? 


Mr. Marty Cioffoletti testified that "I felt that by telling them 
we did not have a sufficient data base and could not analyze the 
trajectory of the ice, I felt he understood that Rockwell was not 
giving a positive indication that we were for the launch." 113 

Mr. Aldrich, conversely, told the Commission that: 


Glaysher's statement to me as best as I can reconstruct 
it to report it to you at this time was that, while he did not 
disagree with the analysis that JSC and KSC had reported, 
that they would not give an unqualified go for launch as 
ice on the launch complex was a condition which had not 
previously been experienced, and thus posed a small addi- 
tional, though unquantifiable, risk.!!* 


Aldrich concluded the meeting by deciding to recommend that 
the countdown continue until the ice team could return to the pad 
just prior to launch and make a final assessment. Aldrich testified 
that he told Jesse Moore about Rockwell's reservations, explained 
his decision, and recommended that the launch proceed unless the 
ice team discovered that the situation had badly deteriorated.!!* 


110 QIS Channel 216, р. 353. 

111 Rogers Commission Report, Volume У, р. 1018. 
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113 Ibid., р. 1014. 

114 Thid., р. 1025. 

115 Ibid. 


242 


The results ої the meeting were reported back to Rockwell over 
the communications system: 

RSR: MSR, this is MER. 

UKN: Go ahead. 

RSR: We just got a report in from Arnie and they’re going to go ahead and go into 
the count. They’re going to go out, sweep down the pad as best they can and remove 


as much ice as they can and go for the launch today. 
ОКМ. We copied that.116 


In their final report, the Ice Team found that ice on the MLP in 
direct sunlight had begun melting. They also found that icicles had 
begun to fall from the upper FSS levels. Ice cube sized pieces of 
these icicles were found within 10 feet of the left-hand SRB hole. 
The west MLP deck was swept clean of ice/icicles. The water 
troughs were checked and found to be forming ice, which was again 
removed using the “shrimp net." 117 

In analyzing launch films after the accident, NASA found that, 
contrary to expectations and analysis, ice from the Fixed Service 
Structure did reach and impact the Shuttle vehicle during liftoff. 
The report stated: 


Numerous launch films were viewed regarding FSS and 
RSS ice debris. A film (E-43) [Engineering Camera 43] 
looking directly in at the vehicle and FSS shows some ice 
falling straight down in the period between SSME ignition 
and vehicle ascent through approximately 20 feet. It shows 
that very many particles fell at approximately a 45° angle 
during the vehicle rise through 20 to 40 feet. This ice in- 
cluded sheet ice particles up to 6 in. x 6 in. and flowed 
down into the plumes at a point directly below the engine 
nozzles. Some of this struck the LH SRB. One downward 
looking camera (E-36) on the FSS clearly showed that a 
small amount of FSS ice debris reached the area of the LH 
SRB exhaust hole. Particles numbered 50-100 and were 
approximately ice-cube size. None of these or any other 
debris was observed to be ejected upward toward the Orbit- 
er. Another film (Е-18) looks upward from the SSME pit. 
This shows that after a vehicle rise of 10 ft. hundreds of 
ice particles flowed in below the main engine at a 45° 
angle. No Orbiter impacts are observed. Camera E-26... 
reveals many small pieces of falling ice striking the LH2 
TSM [liquid hydrogen tail service mast] in the period be- 
tween SSME ignition and vehicle rise through approxi- 
mately 25 feet. Due to aspiration, 50-100 small ice parti- 
cles flowed into the LH SRB plume directly below the SRB 
nozzle as the vehicle rose through 4 to 25 ft. These films 
and others show fairly clearly that there was little or no 
debris damage to the oribiter [sic] during liftoff due to 
FSS/RSS icing for the conditions observed.!18 


In the summary and conclusions section of this report, the fol- 
lowing statements appear: 


116 015 Channel 216, р. 355. 
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Оп STS-33 (511) the actual FSS/RSS ice movement, ав 
proven by the photographic documentation did not con- 
form to the predictions in two important respects: 

2 The ice generally did not release until after SSME ig- 
nition. 

2. The ice translated several times farther toward the 
vehicle than predicted. 

To do meaningful predictions of ice movement, the ef- 
fects of aspiration must be considered. Similarly, the re- 
lease time of the ice must be known. 

Until the above capability is available, it should be as- 
sumed that FSS/RSS ice would be released early and 
pulled by aspiration into contact with the vehicle. FSS/ 
RSS ice thereby could be judged as a potential high risk to 
flight safety.!1? 


The Committee has proceeded at some length to develop the con- 
versations regarding ice that occurred on the morning of 28 Janu- 
ary because they illuminate tendencies that are at variance with 
the careful attention to safety the Nation has come to expect from 
NASA. It is the Committee’s view that the information developed 
by the discussions between members of the ice team and those that 
took place between Rockwell personnel on this subject should have 
led to the conclusion that “FSS/RSS ісе... could be judged a ро- 
tential high risk to flight safety." 

The Committee also notes that, in his presentation to the STS 
Program Manager at the 9:00 a.m. Mission Management Team 
meeting, the ice team leader apparently did not inform Mr. Aldrich 
that he had earlier recommended that the launch be held due to 
the ice in the pad area. There is no indication in testimony to the 
Commission that Mr. Aldrich knew of the team leader’s comment, 
“Well, I'd say the only choice you got today is not to go.” Had it 
been presented to him in those terms, the later reluctance of Rock- 
well to recommend a launch might have been sufficient to cause 
Mr. Aldrich to recommend a launch scrub. In any event, the uncer- 
tainly present in connection with this discussion should have been 
sufficient to cause a delay in the lauch until the ice melted off the 
gantry. The unknown risk represented by the ice would then have 
been removed. 

These conversations also indicate that the launch director was 
not operating in a manner the Committee would expect. Given his 
position as the senior official responsible for the preparation of the 
Shuttle for launch, the Committee would expect a healthy skepti- 
cism to underlie discussions he had with members of the launch 
crew. In contrast to these expectations these tapes demonstrate 
that the director was often reminding the engineering team about 
time, and spent much time questioning the ice team leader’s analy- 
sis of the ice on the pad. There is also no indication that he took 
steps to see that the pad escape system was ready for use by the 
flight crew, if necessary. 


11? Tbid,, р. 4. 
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Finally, Congressman Ron Packard discussed with witnesses at 
the Committee’s hearings on July 25, 1986, ways to improve con- 
tractor participation in preparing the Shuttle for launch. 


Mr. PACKARD. “Мг. Davis, you spoke regarding the com- 
panies having a voice in the decisionmaking, I presume, 
after the FRRs—that two week interim between launch 
and the readiness review system. Do you believe that the 
companies should have more voice, less voice, or have they 
had any voice in whether its a go or no-go?” 

Mr. Davis.}2° “Well, I can tell you how it runs now. Up 
to and including the L-minus-one day review, there’s no 
doubt that every company has a very strong voice; and, as 
a matter of fact, at the L-minus-one review, they are re- 
quired to stand up and commit their hardware as go or no- 
go. And those are very unequivocal commitments, also. 
After that time, then the reviews are more mission man- 
agement meetings that are held, and as you get down into 
the countdown, it turns into more of a real time polling of 
the people that are actually controlling the launch. In 
those latter meetings, we are not, I would say, formally in- 
volved in those unless there is some problem with the 
hardware itself, the External Tank hardware. We are in 
Firing Room 2 in a very significant presence; we are aware 
of what is happening in some of the consoles. We sit 
behind them; we do not operate them. We are polled by 
the Director of Engineering prior to the launch actually 
proceeding, so we are sort of polled in an informal 
manner. We are not asked at any time after the L-minus- 
one for a formal go or no-go. I believe it would probably be 
appropriate, in terms of the Commission’s desires, that 
indeed we be more formally involved in the mission man- 
agement meetings, and that at some appropriate late time 
in the launch count—and I would leave that to NASA to 
decide—that indeed the companies be asked to declare go 
or no-go.” 

Mr. PACKARD. “A quick answer, Mr. Murphy. Do you 
agree?" 

Mr. Murpny.}2! “Yes, I agree with what Rick has said. I 
think that we have found out that we commit ourselves, I 
guess, at 20 minutes and 9 minutes by the people who are 
manning the consoles, but it does not rise to the manage- 
ment level which it should, in accordance with what Mr. 
Davis has stated. We would like that opportunity also." 

Mr. Davis. "Тд like to make one other comment on that. 
] have never felt that if I needed to stop a launch, I could 
not stop it. While I have not been asked for a positive go 
or no-go, the ability is always there if I decide no, to stop 
the launch." 

Mr. РАСКАЕР. “Mr. Jeffs, do you feel the same?" 


120 Му. Richard Davis, President, Martin Marietta Michoud Aerospace. 
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Mr. JErrs.!?? “Yes, I think the system should Бе formal- 
ized more. We have great visibility as to the problems and 
real times, being on the net and having CRTs [console 418- 
plays} and people that are involved in depth, both at 
Downey and at Houston, who support it, even though it’s 
at the Cape. But especially, when you have holds or delays 
and what have you, it needs to be—again—upgraded in 
real time with, I believe, the contractor’s participation 
with NASA management right up to the launch decision 
point, and a little more formal process involved in the poll- 
ing of the contractors.” 

Mr. PACKARD. “Mr. Murphy, if you'd had that system set 
up prior to the accident, would the flight—would it have 
still gone?" 

Mr. Моврну. "It would not have influenced our position 
at all. Our hardware—we had stipulations on what we re- 
quired on the hardware during the whole period. They 
were met, and so we were in a 'go' posture as far as we 
were concerned. It would not have affected our posi- 
tion." 


The Committee believes that had the hardware contractors been 
required by NASA to formally declare their flight readiness, it 
would have removed the ambiguity in Rockwell's recommendations 
involving the ice on the Fixed Service Structure. 


B. LAUNCH REDLINES 


Section VI.B.1.b. of this report describes the rationale for devel- 
opment of certain criteria that serve to indicate when the Shuttle 
system is experiencing problems during the countdown. On the 
morning of January 27 and 28, during the countdown for STS 51-L, 
the launch crew in the Firing Room wrote waivers to certain of 
these criteria in order to permit launch of the Shuttle. Tapes and 
transcripts from the Operational Intercommunication System dem- 
onstrate that, at least in one instance, the technical analysis au- 
thorizing the use of a backup procedure did not account for ambi- 
ent temperatures below the limits specified for this procedure. 
Thus, a waiver should not have been granted. 

Revision C, Amendment 18 of the Launch Commit Criteria speci- 
fied 45 degrees Fahrenheit as the minimum redline temperature 
for the External Tank nose cone.!?* 

But the ambient temperatures during the countdown were well 
below that. On January 27, while the Shuttle waited for liftoff, con- 
versations indicated that the nose cone heaters were not able to 
maintain proper temperatures. Excepts from the transcript of this 
discussion follow. 

CF. Okay, go ahead, Fred. 

FH. Okay, we may have a problem with propellant temperatures at that low 


level. We're about three degrees away from red line and losing ground right now. 
CF. Because of the amount of heat that the ground system's able to put in there? 
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FH. That's right, they're giving us all they can right now. . . .125 

DIRECTOR. . . . What do you guys feel about all the temperatures we saw today, 
like nose cone, and all those? Think about that so we can talk about that a little bit. 

M. Yeah, that's another thing we're not happy about. We think we could probably 
still get by with it, but we're marginal. 

UKN. You know, nose cone temp. Horace, is probably gonna be down in the low 
20's, maybe even below 20. 

M. I think the intertank we ought to be able to keep it up high enough. . . .128 

DIRECTOR. . . . Okay. You guys think that nose cone heater is putting out all we 
gonna be able to get out of it? 

UKN. Yep. You got it full blast. You're gonna be down 18-20" tomorrow on the 
nose cone. Апа the waiver we wrote today said we're only good down to 28. That 
was today's. . .. 

ОКМ. And Horace, the {intertank] heater was running full bore for quite awhile. 
And we were running at least 10? below the set point temperature. 

Direcror. What about Fred Heinrich? He оп 245? 

FH. I'm here, Horace. 

DIRECTOR. Fred, what do you think about the flow rate, 1 mean the RCS temps? 

FH. Okay, Grady said they can crank that thing up locally and get outside the 
OMRSD (Operations Maintenance Requirements and Specifications document] limit, 
which may be enough, but we need to get started as soon as we get in there. Other- 
wise, we can't get the tank warm enough. We're going to lose ground all throughut 
the cryo load. 

DiRECTOR. Okay. 

FH. We're about 3° away from red line right now. We lost some during this cryo 
load with full bore on the heaters. 

Director. Okay. 

R. Horace, this is Robinson, We'll have to check with JSC about the upper limit 
on this temperature. 

Піккстов. What do you mean? 

R. —right now OMRSD is not in—it may be something else other than Fred Hein- 
rich's temperatures. 

DIRECTOR. Okay. Then you don't have no problem picking it up, though, that's the 
only requirement we got, right? 

К. That's affirmative. 127 


The waiver referred to in this conversation offered the following 
technical rationale: "Мо visible ice buildup on the nose cap fairing 
exit area. Temperature is 12 deg F below redline."1?8 

The waiver also read, "Ког STS-33 [51-L] Min LCC acceptable is 
28 deg F (was 45 deg F). Ullage transducers are acceptable down to 
28 deg F (was 40 deg F). Refer Note A, LCC 5.1-4." 129 


Note A read: 
“The following purge temps are backup measurements. 
GLOT 4104A PRI Nose Cone Heated Purge Temp. 
GLOT 4604A SEC Nose Cone Heated Purge Temp." !39 


These refer to telemetry data channels. As the temperatures are 
received via telemetry, they are to be interpreted by means of a 
curve shown on page 5.1-4B.!?! 

It is important to note that Note А applies only if the ambient 
temperature is between 40 and 99 degrees F. Otherwise, the redun- 
dant procedure is invalid. 

As for the effect of exceeding this redline, the launch commit cri- 


teria reads: 
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“The minimum redline was established for two reasons. 
5 А. L02 ullage pressure transducers calibrated to 40 deg 

В. Avoid ice buildup at nose cone fairing exit." 

“Consequences of exceeding redline; 

1. Ice build up and possible impact to Orbiter. 

2. Inaccurate ullage pressure readings." 132 


| Engineering support communications continued with the follow- 
ing: 

M. Horace, 245. 

Director. Yeah, go ahead. 

M. Okay, one other thing’s been brought to my attention. The, the LOX, the LOX 
ullage pressure transducers are calibrated to a minimum of 40 degrees and maxi- 
mum of 140, which is what sets our minimum in the nose cone. Below that, we may 
get some variations in reading. 

FH. No, that’s not true, Mark. 

M. Well, okay. 

FH. (garbled) see I got some measure readings here from Mark was. . 

M. That's what's on the LCC backup page. 

UKN. Read the LCC backup page on the lower limit. 

M. It says 40 degrees. 

mn з for reasons of ice and frost at that the exit оп the fairing. 

. Yeah. 

MAC. Test on 245. (garbled). . . 245. 

DIRECTOR. Go ahead, Мас. 

MAC. Hey, are you guys reading this LCC that the consequences of exceeding the 
nose cone temp redline? The sheet we have over here says that we will get inaccu- 
rate ullage pressure readings. 

Director. Okay, Мас, we understand, thank you.!33 


On the morning of January 28, the following discussions between 
engineering support personnel were also directed toward waiving 
the launch commit criteria on the External Tank nose cone. 


UKN. Dave, they were, of course, expecting to violate those ET nose cone purge 
temps LCCs again. It’s 20 degrees colder today than it was yesterday. 

D. Well, I guess ме’ be going down the line producing a waiver to the same 
effect that we produced yesterday. 

UKN. How did we just define it yesterday for 51L? Or for this attempt for 51L? 

D. Copy your whole question. Say again? 

UNK. I thought we just annotated it yesterday as for 51L only. 

D. That may be it, ГІІ check the waiver log. . . . 

UNK. Dave? 161. 

D. Go ahead. 

UNK. Yeah, it is effectively 51L, I think we are in good shape. 

D. ОК. 134 


Later on the morning of the 28th, the following discussion oc- 
curred: 


Г. FR[Firing Room] 2, this is FR[Firing Room] 1. 

UKN. Yeah Chris. 

D. This is Dan. We need to send a waiver over for signatures. We’re right now 
showing nose cone gas temps that we were discussing yesterday are down in the 12- 
16 degree range and the waiver that we wrote yesterday for 51L only gives us allow- 
ance down to 28 degrees F. 

UKN. Yeah, we'll have to rewrite that waiver. 

D. OK. You don’t think we'll have any trouble getting that signed? 

UKN. No, as long as our pressure transducers are OK. 


132 [bid , р. 5.1-4. 

133 OIS Channel 245, pp. 220-21. 

134 015 Channel 161, р. 289. Channel 161 is identified as an Engineering channel used for 
troubleshooting and systems integration. 
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D. OK. What number would you like to use оп that Horace? 135 


Shortly after this conversation concludes, the discussion on pre- 
paring the ET nose cone temperature waiver continued. Told 
"[W]e're right now sitting at 10 [degrees]? KSC's Director of Engi- 
neering said: 


Director. Let's hold on a minute and then we'll write the waiver, we'll probably 
wanna go below 10. 

UKN. Yeah, we may just want to say no low and put a note on there that based 
on the pressure transducers. 

Director. OK, so you want us to stand by and wait on that? 

UNK. Yeah. 

Director. ОК. We'll be waiting.!35 


If engineers intended to apply the same rationale for waivers as 
that used on Janury 27, the rationale is invalid. Ambient tempera- 
tures were well below the 40 degree limit necessary for a valid 
backup procedure. Therefore, the backup procedure should not 
have been employed. 

Later, in a discussion between the Launch Director and the Di- 
rector of Engineering regarding countdown problems, the following 
discussion about the temperature waiver took place. 


LD. OK. I understand we're in the process of writing a new waiver with a lower 
limit of 10? 

Director. We're still looking. We'll give you a low limit. 

LD. What are they running today? 

DIRECTOR. It's been down as low as 10 basically. 

LD. Wow! 137 


It was іп а subsequent discussion between the same principals 
that the new limit was established. Their conversation, however, 
does not reflect that the limit was chosen by rigorous technical 
analysis. 


LD. We have nothing else, Horace, not unless you guys are working something. 

Director. No, just the ice. 

LD. OK. The only outstanding item we have right now is the one waiver on the 
cone temps. 

Director. OK. It looks like we probably could say about 10° and be OK on that 
one. 

LD. OK. We'll use 10° then. 

Director. ОК.138 


Completing preparations of the waiver, the Director had the fol- 
lowing conversation with one of the technicians. 


DIRECTOR. OK, Jackie, in writing this waiver for nose cone temps we want to put 
the words on here saying that we can use the ullage transducer as an alternative 
way of determine redline, but we believe that yesterday Warren Wiley was saying 
that they had looked at those and they're good down to approximately 11 degrees 
and we wanted to verify that. 

J. I think they did to 10 degrees. 

Director. 10? 

J. Yeah. 

Director. The ullage transducers. 

4. OK. Thank you, Horace.!?? 


135 fpid., p. 296. 
136 Thid., p. 297. 
197 Thid., p. 299. 
133 Thid., p. 302. 
зэв Thid., p. 305. 
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There is по documentation to describe the method by which the 
ullage pressure transducers were qualified to “10 degrees." No а!- 
ternative analysis is described on the launch commit criteria to 
support use of this low temperature as a rationale for approving a 
waiver. 

This example indicates that NASA personnel do not necessarily 
employ a sufficiently rigorous engineering analysis to the waiver of 
launch commit criteria during countdown. There also appears to 
have been some confusion as to the effect of exceeding the redline 
temperature. Ullage pressure readings may be critical parameters 
d 15 to the Main Engine controllers during flight. According to 


Following engine ignition at about T-4 seconds, the 
ullage pressure is supplemented using propellant gases va- 
porized in the engine heat exchangers and routed to the 
two ET propellant tanks. The tank pressure is maintained 
based on data inputs from ullage pressure sensors in each 
tank to control valves in the Orbiter. A combination of 
ullage and propellant pressure provides the necessary net 
positive suction pressure to start the engines. The net posi- 
tive suction is the pressure needed at the main engine 
pump inlets to cause the pumps to work properly. The 
pumps, in turn, supply high-pressure liquid oxygen and 
liquid hydrogen to the thrust chamber. Acceleration pres- 
sure is added for operation. Fuel is forced to the engines 
primarily by tank pressures and, to a lesser degree, by 
gravity.!*? 

Inaccurate readings from these sensors might cause the engines 
to operate improperly. 

Also, according to the launch commit criteria, violations of 
launch redlines may also have occurred on the Auxiliary Power 
Unit (APU) gearbox lube oil (minimum redline temperature 42 deg 
F), and the fuel test lines (minimum temperature 41 deg F), if in 
fact the actual temperature were lower than minimum.!*! 

There was also no mention of the 34.2 deg F minimum redline 
temperature for the SRB recovery batteries or what the tempera- 
ture of the batteries was at launch.!*? 

Under "Remarks," this criterion states, "Violation of this redline 
shall require an assessment to determine if a hazard exists which 
jeopardizes the Shuttle. . . .” 143 

Mr. Mulloy testified before the Commission that: 


Mr. Миллоү. “І had a discussion оп my SRB loop with 
the SRB people dealing with the question of a 24-hour 
turnaround to attempt to launch again at 9:38 on the 28th 
and the effect that the predicted cold temperatures for the 
night of the 27th might have on that. 

The input was received back both to Mr. Reinartz and 
myself that we were looking at the Launch Commit Crite- 


140 NASA, “Space Shuttle News Reference,” 1981, р. 2-40. 

141 “Lauch Commit Criteria and Background," Amendment 20, р. G-23. 
142 Ibid., р. G-1 

143 [bid. 
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па relative to temperatures. It was felt there was а need 
to look at the recovery battery temperatures that are in 
the forward skirt of the SRB and the fuel service module 
temperatures that are in the fuel service modules for the 
thrust vector control system in the aft skirt of the solid 
rocket booster. 

The input received back by me was that they did not 
fee] that would be of any concern. They were going to con- 
tinue to look at it, and if any concern arose they would let 
me know. 

I went to the 2:00 Mission Management Team and re- 
ported that there were no constraints to the solid rocket 
booster for a 24-hour turnaround, that we had taken a look 
at the recovery battery temperatures and the fuel service 
module. We did not feel at this time that there would be 
any Launch Commit Criteria for the low temperature 
limits that were established for those systems, but that we 
were continuing to assess that; should anything change in 
that regard, I would so report that.” 

Chairman Rocers. “You referred to the Launch Commit 
Criteria. What were they as far as you knew in terms of 
weather conditions? Any?” 

Mr. Mu voy. “In terms of weather conditions, yes, sir, I'm 
aware that there is a Launch Commit Criteria for the 
system for weather. There are a number of factors in that 
Launch Commit Criteria. One of them is the ambient 
temperature, which is established at 31 degrees. 

Another is the sea state and winds in the SRB recovery 
area. Another is the cross-winds at the return to landing 
site runway at Kennedy Space Center. Another is the 
trans-Atlantic landing site weather, and another is severe 
weather, which is related to lightning and thunderstorms 
in the area.” 

Chairman Rocers. “And when you say there were no 
constraints in the 2:00 meeting, does that mean that as far 
as you could see there were no problems in those areas?" 

Mr. Милох. “Мо, sir, I did not evaluate those areas of 
the Launch Commit Criteria. What I was looking at was 
the specific Launch Commit Criteria items that are on the 
solid rocket booster and the effect that the low tempera- 
tures would have on that. 

I would expect Mr. Aldrich would normally make the 
judgements on, and his people at the Johnson Space 
Center, would make the judgements on crosswinds and 
trans-Atlantic weather and the general ambient environ- 
ment for launch." 144 

While there is no reason to believe that these waivers directly 
contributed to the cause of the accident, the low temperatures 
during the night of the 27th and morning of the 28th most prob- 
ably did. Committee staff learned in discussions with Thiokol per- 


144 Rogers Commission Report, Volume У, рр. 821-28. 
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sonnel 145 that liquid hydrogen apparently remained in the Exter- 
nal Tank throughout the night of January 27. This most likely 
played a role in the joint seal failure, since it permitted heat trans- 
fer through the ET/SRB aft attachment strut throughout the 
night. Of equal interest, however, is the fact that ET requires an 
eight-hour recovery period between tanking cycles, measured from 
the time the hydrogen tank low-level sensors are 4гу.146 

If the hydrogen tank was never emptied during the turnaround 
procedure, this would represent a violation of those criteria. Had 
the criteria been observed, STS-51L would have required an after- 
noon window on January 28, or it might have been necessary to at- 
tempt the launch on January 29. This has not been independently 
confirmed, however. 


145 Discussion with Carver Kennedy, Thiokol Wasatch Operations, Brigham City, Utah, Sep- 
tember 4, 1986. General Kutyna also noted this іп the Commission's hearing on February 14, 
1986 ( Commission Report, Volume IV, p. 660). 

146 015 Channel 245, р. 218. 


IX. DEFINITIONS OF TERMS AND ACRONYMS 


AA-SF—Associate Administrator for Space Flight. 
AFPRO—Air Force Plant Representative Office. 
APU—Auxiliary Power Unit. 

BOC—Base Operations Contractor. 

BTU— British Thermal Unit. 
CAR—Configuration Acceptance Review. 
CDR—Commander. 

CDR—Critical Design Review. 

CIL—Critical Items List. 
CoFR—Certification of Flight Readiness. 
CPIF—Cost-plus, Incentive-fee. 
CTS—Call-to-stations. 

DAR—Deviation Approval Request. 
DCAS—Defense Contract Administration Service. 
DCR—Design Certification Review. 
DFRF—Dryden Flight Research Facility. 
DR—Discrepancy Report. 

EG&G—Edgerton, Germeshausen and Grier. 
ESMC—Eastern Space and Missile Center. 
EST—Eastern Standard Time. 

ET—External Tank. 

FEAT—Flight Element Assignment Table. 
FDO—Flight Dynamics Officer. 
FMEA—Failure Modes and Effects Analyses. 
FRR—Flight Readiness Review. 

FSS—Fixed Service Structure. 
GOX—Gaseous oxygen. 

GSE—Ground Support Equipment. 
НА--Нагага Analyses. 

HDP—Holddown Posts. 

ILL—Impact Limit Line. 

IPR—Interim Problem Report. 
IR—Infra-red. 

IUS—Inertial Upper Stage. 

JSC—Johnson — Center. 

К5С—Кеппеду Space Center. 
ksi—thousands of pounds per square inch. 
LCC—Launch Control Center. 

LFC—Left Forward Center. 

L/H—Left Hand. 

LOS—Loss of signal. 

LOX—Liquid oxygen. 

LPS—Launch Processing System. 
LRU—Line Replaceable Unit. 
MEOP—Maximum Expected Operating Pressure. 
MER—AMission Evaluation Room. 
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MLP—Mobile Launch Platform. 

ММТ--Мізвіоп Management Team. 

MRB—Material Review Board. 

ms—millisecond. 

MSFC—Marshall Space Flight Center. 

MST—Mountain Standard Time. 

NASA—National Aeronautics and Space Administration. 

NRC—National Research Council. 

NRP—National Resource Protection. 

NSTS—National Space Transportation System. 

NTD—NASA Test Director. 

OASCB—Orbiter Avionics Software Control Board. 

OIS—Operational Intercom System. 

OM—Operations Manual. 

OMI—Operations Maintenance Instruction. 

OMP—Operations and Maintenance Plan. 

OMRSD—Operations Maintenance Requirements Specification 
Document. 

OMS—Orbiter Maneuvering System. 

OPF—Orbiter Processing Facility. 

PAC—Problem Assessment Center. 

PAS—Problem Assessment System. 

PDR—Preliminary Design Review. 

PGHM—Payload Ground Handling Mechanism. 

PR—Problem Report. 

PRCBD—Program Requirement Change Board Directive. 

psig—pounds per square inch gage. 

PSP—Processing Support Plan. 

QC—Quality Control. 

RCS—Reaction Control System. 

R.F.—Radio Frequency. 

RPSF—Rotation, Processing and Surge Facility. 

RSO—Range Safety Officer. 

RSS—Range Safety System. 

RSS—Rotating Service Structure. 

RTLS—Return to Launch Site. 

SCA—Shuttle Carrier Aircraft. 

SPC--Shuttle Processing Contractor. 

SRB—Solid Rocket Booster. 

SRM—Solid Rocket Motor. 

SR&QA —Safety, Reliability and Quality Assurance. 

55МЕ--5расе Shuttle Main Engine. 

5Т5--5расе Transportation System. 

TBD—to be determined. 

TDRS—Tracking and Data Relay Satellite. 

TM—Telemetry. 

TSR—Technical Status Review. 

TVC—Thrust Vector Control. 

VAB—Vehicle Assembly Building. 

VPF—Vertical Processing Facility. 

WAD—Work Authorization Document. 
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‚ NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 


WASHINGTON, D.C. 1054 


ATTN Of: 50-1 


MEMORANDUM | 7 
ТО: Marshall Space Flight Center A" 
tin: Mr. Garland б. Buckner 
Золбин Procurement Officer 1 


TERU: Marshall Space Flight Center 
Mr. Roy E. Godfrey 
SEB Chairman 
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Review Division 
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Selection of Contractor for Space Shuttle Progrec 
Solid Rocket Motors 


Subject statement, signed by the Administrator, is enclosed for 
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of же Administrator's Statement for the SES Chairnan. 
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THIOKOL CHEMICAL CORPORATION 


Thiokol presented an approach to the SRM Program which 
clearly focused on maximum utilization of existing facilities 
and low early vear funding. In-house production effort 
would be accomplished in the Wasatch Division, Utah facility. 
Increment III production would be accomplished by acquisition 
of portion of the adjacent Air Force Plant 78 as Air Force 
requirements phased out. AP requirements would be met by 
increasing the capability of existing facilities in nearby 
Henderson, Nevada. Use of an existing, skilled, stable work 
force in a low labor rate area would minimize new hires and 
provide low labor costs. Thiokol's decision to fabricate 
nozzles in-house provided cost savings and good control over 
this extremely critical component; however, the Board con- 
cluded that this introduced some early risk because of lack 
of experience in fabricating nozzles of this size. Facility 
location resulted in high transportation cost of the SRM's; 
however, these costs were more than offset by low facility 
investments. The Thiokol proposal received the second 
nighest overall Mission Suitability score by the SEB, being 
tied with UTC. The SEB ranked Thiokol fourth under the 
Design, Development and Verification Factor, second under the 
Manufacturing, Refurbishment and Product Support Factor and 
first under the Management Factor. 


Design, Development and Verification 


The Thiokol case design met the general SRM requirements; 
however, the cylindrical segment was close to the upper limits 
of size capability of the case fabricator. The nozzle design 
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included ablative materials not currently deveicped or 
characterized. This offered potential savings in program 
cost, but with attendant technical and program risk. Ап 
expanded characterization and development program would be 
required. The thickness of the nozzle material was insufficient 
to meet required safety factors and thus degraded reliability. 
The amount of material required to correct the deficiency was 
substantial and the deficiency could require a redesign of 
the metal portions as well as the ablative portions. The 
design was complex and would contribute to difficulty in 
manufacturing. The Thiokol motor case joints utilized dual 
O-rings and test ports between seals, enabling a simple 

leak check without pressurizing the entire motor. This inno- 
vative design feature increased reliability and decreased 
operations at the launch site, indicating good attention to 
low cost DDT&E and production. The thickness of the internal 
insulation in the case aft dome was marginal and created a 
technical risk. 


Thiokol provided cumprehensive test plans and development 
verification objectives; however, they proposed to verify 
propellant burning characteristics by testing four to six 

full scale mixes which was excessive, and could be reduced 

by establishing correlations with smaller mix size data during 
DDT&E. Also, Thiokol proposed to hydroburst two motor case 
assembly specimens, whereas one test would be sufficient. 


Manufacturing, Refurbishment and Product Support 


Thiokol had extensive processing experience with their proposed 
propellant formulation, having processed over 150 million 
pounds of this generai type of propellant.  Thiokol's major 
weakness in this area of evaluation was in the area of case 
fabrication. The segment fabricator would be чпарје to 
fabricate the case segments strengthened with stiffening rings 
as proposed by Thiokol for alternate water entry load 
conditions, if required. This would probably require a case 
and grain redesign.  Thiokol's manufacturing approach provided 
a good mechanized method of installing insulation, coupled 
with an innovative method of preparing the insulation surface 
for the liner by peeling off a dacron cloth from the inner 
surface of the insulation. A minor weakness in the manu- 
facturing approach was the decision to fabricate nozzles 
in-house.due to Thiokol's lack of experience in fabricating 
nozzles of this 'size. E" 


258 


8 


Thiokol proposed to utilize existing facilities which, with 
піпох mocicicaticns, were totally adequate for all three 
increments. The one exception to this was a failure to meet 
Quantity Distance safety requirements between casting pits 
for Increment III, however, there are ways to adequately 

ure this problem. Thiokol maximized the refurbishment of 
components and the potential cost savings provided by refurbish- - 
ment. Апсспег less significant strength was the enhancement 
of segment assembiy providec by three alignment pins thereby 
reducing the assembly hours on the launch pad. Thiokol 
failed to provide enough new cases and nozzles to meet the 
launch schedule. Eight additional cases and nozzles would be 
required to provide assurance that launch dates could be met. 


Management 


Thickol structured the development program so that all major 
costs were deferred to the latest practicable date. This 
resulted in low early year funding, which is a key program 
objective. The availability of an operating plant, with 
ample experienced personnel and a proven organization which 
could be pnased to the SRM effort with minimum modification 
added considerable maturity and confidence and proved to be 
cost effective. The Board considered this to be a major 
strength for all three increments. А strong matrix manage- 
ment was evident and key line organization supervisors were 
experienced and had worked together as a team on many 
successful development and production programs such as 
Minuteman and Pcseidon. Strong management participation and 
visibilitv in variance analysis was another strong feature 
as was the approach to corrective actions and their effect on 
estimate-to-complete. Procurement Management was thorough 
and well planned. SRM commodity purchases would be consoli- 
dated with that of other programs at Wasatch, which should 
result in lower cost. The Procurement of major items was 
weil matcned to overall SRM schedule requirements.  Thiokol 
proposed a strong Configuration Management System wnich 
included thcrough identification and traceability during 
DDT&E, production and refurbishment. The tentative decision 
to make the molded and tape wrapped nozzle in-house was 
considered a strength in this area. It would contribute 

to the low cost-per-flight goal by using available resources, 
avciding subcontract fees, lowering overhead rates, and taking 
advantage of lower cost labor. The inherent risk management 
aspects also were considered. 
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In the area of Kev Personnel, the proposed Program Director 
was considered exceptionally strong and had successtuliy 
performed as a Project Manager on other majcr programs. Не 
is widely known for his excellent performance. The proposed 
Deputy Program Director would also be the Chief Project 
Engineer. He had important and successful engineering 
management roles in previous major motor programs and has 
-.an.excellent reputation in the trade. ын --- oe 


Although adequately qualified for their proposed assignments, 
the proposed Functional Managers and their Team Members in 
the Project Organization did not reflect the depth of ехрегі- 
ence available in the Functional Departments of the Thiokol 
Matrix type organization and had not previously performed 

as a team. This was not considered a significant weakness 
ру the Board because of the strong experienced matri 
organization at Thiokol. 
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PROGRAM PLAN 


PROTECTION OP SPACE SHUTTLE SRM 
PRIMARY MOTOR SEALS 


1.0 INTRODUCTION 


There have been incídents on SRM flight and static test motors 
where a primary o-ring has been slightly charred by hot gases which 
penetrated through the vacuum putty barrier. Motors affected thus far 
are STS-2A aft field joint, QM-4 nozzle joint, STS-11A forward field 
joint, STS-11B nozzle joint, and STS-13A nozzle joint. This program 
plan will result in defining the solution to this o-ring char. 


2.0 OBJECTIVE 


The program objectives are to systematically isolate the problem 
and to eliminate damage to SRM seals. 


3.0 APPROACH 


The program approach will consist of апаїувів, subscale (hot) 
tests, full-scale joint tests, and final verification in motor static 
testing. 


The analysis vill attempt to identify the cause of o-ring erosion, 
its acceptability, and justification. It will identify specific design 
or process changes which will eliminate further o-ring charring. 
Studies vill be performed showing the effects of material variation 
characteristics, putty layup configurations, and fresh materials versus 
environmentally exposed putty. In conjunction with these analyses, a 
thorough study will be performed on material from alternate sources. 


Testing will include laboratory material characterization, small 
motor hot tests simulating effects on cavity volume variations, flow 
patterns, exposure of o-ring and lubrication effects. The burn time of 
small hot motors vill be in the range of 3 ~ 30 seconds depending on the 
results of previous small ecale motor test results. Morton Thiokol aleo 
recommends that actual full-scale segment joint tests be used to 
evaluate pressurization effects on putty layup arrangements and flow 
changes due to final assembly of the joints, It is further suggested 
that a group of experienced people from MSFC and МТІ be selected to 
witness the entire joint preparation, assembly, leak testing, and 
postfire teardown at KSC and MTI/Clearfield facilities. This team will 
aleo review all analyses, laboratory tests, subscale hot test, and 
support team reviews. 
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MORTON THIOKOL INC. 


3.1 Analysis 


The following tests shall be performed on the vacuum putty as a 
minimum. If furcher testing is required, it shall be performed and 
documented. Some of the tests are currently being performed on the 
existing putty, but are listed to assure that presently available data 
are summarized in the ensuing report. These tests will have to be 
repeated on any potential new putty. (See section 3.1.5) 


3.1.1 Chemical Composition 


Ал analysis vill be performed on the putty to determine 901148 
content, asbestos fiber (ок other filler) content, chromate content, 
binder makeup, and all other applicable teste described in STW4-2847, 


Putty, Vacuum Seal. 
3.1.2 Physical Properties 


Teeta shall be developed and conducted to determine adhesive 
strength of the putty (tackiness), strain capability, compressibility, 
and resistance to heat, erosion, and pressure shock (at SRM ignition). 


3.1.2.1 Environmental Effects 


The putty vill be conditioned ín controlled temperature and 
humidity environments, including ambient conditions at Utah and Florida, 
then tested for all physical properties and appropriate chemical 
properties such as non-volatile content and water solubility. 


3.1.3 Aging 


An aging program víll be conducted on puttv in Utah and Florida. 
The progrem should run for five years with particular emphasis during 
the first year at 3, 6, 9, and 12 months. Chemical and physical tests 
shall be performed at each etage of aging. The putty vill also be 
checked for shrinkage and silicone migration from the paper backing used 
as а separator іп the roll] fors. 


3.1.4 Compatibility of Putty With Other Materials 


The putty will be tested to determine effects of its mixing with 
Conoco HD-2 grease, cured NBR rubber, and both fresh and saltwater. If 
the materials react, properties of the resultant material will be 
established. Tests shall also determine whether the resultant material 
is corrosive to the D6AC case. 
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3.1.5 Second Source for Putty 


A second (ог third) source of putty 18 desirable to prevent further 
supply problems, which could seriously impact the Space Shuttle program. 
A development program vill be implemented to test alternate putty 
candidates per the preceding requirements as a minimum. Subscale firing 
tests shall use the alternate putty to establish confidence to install 
the new putty in FWC-SRM static firing DM-6 for putty qualification. 


There are three alternate source candidates at this time: Plastic 
Sealer 579.6 from Inmont Corporation of Georgetown, Ontario, with 
asbestos and Plastic Sealer 579.6 from Inmont Corporation, St. Louis, 
without asbestos. General Sealants is developing a high temperature 
putty that will also be screened. 


3.1.6 Viton Characceristics 


To aid the accuracy of the hot gas jet analysis, tests vill be run 
to determine the erosion rate of Viton. These data, along with results 
from other tests described in this plan, will be used when the analysis 
is redone. | 


3.2 Subscale Firing Tests 


3.2.1 Five Inch CP Motor 

To verify that hot gas jeta through the putty openings is correct, 
tests will be conducted which induce е gas jet impingement on an o-ring 
using five inch CP motors as test beds. Under tightly controlled 
conditions (environmental and mechanical), this data will be assessed to 
more fully understand what is happening in the SRM applications. 


If a meaningful subscale joint test can be devised with putty in 
it, it will also be performed using the five inch CP ав the hot дае 
source. ў 


3.2.2 40 Lb. Char Motor 


Depending on the results of the five inch CP hot teating, it may be 
desirable to include larger scale test motors having putty inetalled. 
Morton Thiokol is investigating the 40 Ib. char motors. If required, 
such tests shall be performed to further verify the change in putty 
layup, type, and/or other filler materials. 


3.3 Full-Scale Joint Tests 


Testa shall be performed using e full-scale SRM field joint to 
verify the subscale results of the candidate putty layup confígurations 5 
ав affected by the actual joint assembly and leak test procedures. The 
“short stack" hardware is preferred for use instead of SRM case segments “ 


for ease of assembly and inspection. The following questions shall be ч 
ansvered as minimum requirements of this test sequence: 5 
оос 
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Таны! Орорувчитовя, о Фаізонійюту 60 


MORTON THIOROL inc 


Улсаа Division 


a. What is post assembly pressure in the cavity between the 
putty and the primary o-ring? 


b. What is the minimum pressure required to blow through the 
putty? 


c. What is the maximum acceptable leakage rate at 200 psig which 
meets the 50 psig leak test criterion? 


4. How is o-ring seating affected by pressure and time? 


е. What is the proper amount of HD-2 grease to be applied to 
the joint metal curfaces to minimize the free volume between 
the vacuum putty and the primary o-ring? 


f. What is the effect of case eccentricity during segment mating 
on the flow of vacuum putty in the joint? 


8- What dimension and weight controls are required to assure 
the vacuum putty layup is consistent and adequate? 


Potential fixes will be investigated such as inducing paths through 
the vacuum putty at regular circumferential intervals to prevent 
localized o-ring damage caused by small, supersonic gas jets. The 
concept of a soft rubber barrier between the putty and primary o-ring 
will also be investigated. Іп addition, leak check procedures, 
particularly those employing the use of a flow meter, vill be examined 
with acceptable and non-acceptable (leaking) o-rings. In all instances 
the behavior of the putty shall be closely monitored. 


Results of the above described tests víll be extrapolated to the 
nozzle to case joint and tests using a full-scale nozzle fixed housing 
and aft dome will be conducted, if necessary, to verify the adequacy of 
апу change resulting from the field joint tests. 


A plan, TWR-13983, has been prepared to check the putty 
configuration of the igniter to case joint. These tests will also be 
conducted and the results víll be summarized in the final report. 


3.4 Full-Scale Static Test 


All potential design changes will be adequately tested on the 
subscale level and shall be incorporated into the SRM-FWC static firing 
DM-6 for qualification. А critical postfire inspection vill be 
performed on the new configuration as vell as the baselined portions of 
the DM-6 joints. 


An analysis will be performed to assess the results of the FWC-SRM 
field joints as they compare to the HPM-SRM field joint. The field ` 
joints are shown in figures 1 and 2 for HPM-SRM and FWC-SRM, 
respectively. 


TWR-14359 '' 
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3.5 Review and Witness Tean 


A review and witness team shall be established consisting of 
experienced engineers from Morton Thiokol and NASA to inspect and assess 
all test results. Anomalous conditions of joints from flown motors 
shall be critically inspected by members of this team. Тһе teas will 
determine the course of action to be taken as intermediate and final 
results become available. 


4.0 SCHEDULE 


The attached schedule reflects the time available to complete the 
testing and qualification of the preceding ítems. 


5.0 REPORT 


A comprehensive report shall be prepared by Engineering documenting 
the tests and results. The original shall be released after the 
development testing, but prior to DM-6. А revision shall be released 
after DM-6 and a second and final revision shall be published after the 


aging program. 


REVISION : vou. 
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EP25 (84-49) Е Мау 23, 1984 
то; EE11/Mr. Horton 

FROM: EP25/Mr. Miller 


SUBJECT: Evaluation of TWR-14359, "Program Plan, Protection of Space 
Shuttle SRM Primary Motor Seals" 


The subject Program Plan has been evaluated as requested and the following 
comments are submitted for your consideration: 


a. Page 3, Paragraph 3.1.2, Physical Properties - This Program Plan 
mentions compressibility testing of the zinc chromate putty, however по 
laboratory tests are proposed which will determine the extrusion 
characteristics (displacement in a free volume under compression load) of 
various candidates. This should be accomplished to provide a better 
understanding as to why various types of putty exhibit unlike extrusion 
patterns with identical layups. 


b. Page 4, Paragraph 3.1.5, Second Source for Putty - A second source 
for гіпс chromate putty is desired and needed, but due to the poor 
performance of the Randolph putty, a more immediate need exists for 
development of a replacement for the present Randolph putty. Recommendation 
to this effect was made in Memorandum ЕР25 (84-35). 


c. Page 4, Paragraph 3.2.2, %0-Рошта Char Motor ~ The 40-pound char 
motor should be made a definite part of the Test Program. It is vital that 
the test article be capable of simulating the total joint configuration as 
close as possible, which includes zinc chromate putty. Provisions for the 
install^cion of the putty together with extended burn time and increased 
volumes ^;patilities are achievable with the larger motor and should бе 
included in the total program. 


d. Page 5, Paragraph 3.3, Full-Scale Joint Tests, Reference: first 
paragraph following "g". Please explain how potential fixes such as 
inducing paths through the putty at regular circumferential intervals and 
изе of a soft rubber barrier between the putty and primary O-ring will be 
verified by hot firing prior to installation on DM-6. 


e. Page 5, Paragraph 3.3, Full-Scale Joint Tests, Reference: Second 
paragraph following "g". Тһе Test Plan should specify a hard requirement to 
verify all potential nozzle/aft dome joint changes on full-scale hardware. 
` The case joint and nozzle joint configuration differences warrant separate 
full-scale nozzle/aft segment assembly tests. 
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г. General - Design changes to the insulation interfaces which will 
prevent degradation of the thermal barrier due to joint rounding under 
pressure should be investigated as a part of this effort. The present 
design of the case jaint and nozzle interfaces where the zinc chromate putty 
ts installed are oriented such that the joint gaps can vary from minimum to 
maximum dimensions around the circumference during assembly due to out of 
roundness and eccentricity. This condition which is present to some degree 
during every joint assembly operation, guarantees that some, or almost all 
of the zine chromate putty in certain areas will be wiped off when the 
mating surfaces move parallel to each other during mating. This results in 
open insulation gaps with insufficient zinc chromate putty during motor 
operation because the joints tend to become round and concentric when the 
case is presssurized internally. 


Questions concerning this memorandum should be referred to Mr. William L. 
Ray, 3-3809. 
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John Q. Miller 
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National Aeronautics апа 
Space Administration 


George C. Marshall Space Flight Center 
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aew ıo Amol EP25 (83-119) December 6, 1983 


то: EE51/Mr. Horton 
FROM: EP25/Mr. Miller 


SUBJECT: Request for Tests by the Contractor tc Obtain Space Shuttle SRM 
Clevis Joint, Fixed Housing/Aft — Joint and Igniter Adapter/ 
Forward Segment Joínt Leak Check Da 


It is requested that you take formal action to assure that the following tests 
are performed in a timely manner by the contractor, Morton/Thiokol, on SRM 
Hardware: 


а. Case Clevis Joint Dual O-Ring Seal Leak Detection - Perform tests with 
full ue clevis joint hardware (short joints) to obtain the following data ^ 
as а minium: 


(1) Post assembly pressure іп the zinc chromate sealant cavity. 


(2) Minimum and maximum volume of the zinc chromate sealant cavity, 
post assembly. 


(3) Minimum pressure required to effect zinc chromate sealant blow 
through. 


(4) Bleedback capability of the primary seal (from sealant cavity to 
cavity between the primary and secondary seals) at a variety of pressure values 
ranging from 10 psig up to a value which has been determined to effect sealant 
blowthrough. Various types of primary seal leakage conditions at predetermined 
leakage ratas shouid be simulated. 


(5) Determine maximum acceptable leakage rates at 200 psig which meets 
the 50 pstg leak test criteria. 


(6) Determine minimum pressure and time required to position O-rings 
for 50 psig leak check. 


(7) Determine the volume of the cavity betwaen the primary and secondary 
O-rings by analysis and flow test prior to and following the 200 psi O-ring 
positioning cycle. 


(8) KSC and МТТ GSE volumes should be simulated and the required tempera- 
ture range should be duplicated as close as possible. Туре ІІ гіпс chromate 
sealant should be used for all tests. i 
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b. Nozzle Fixed Hous{ng/Aft Segment Boss Joint - Perform tests with full 
scale hardware to accomplish the objectives in item a. above. The test designed 
to determine O-ring bleedback rate need not be repeated. 


c. Igniter Adapter/Case Forward Segment 8055 Joint - Perform tests with 
full scale hardware to accomplish the objectives іл item а. above. Tests to 
determine pressure value required to position the seal fs not required. 


It 15 highly desirable to complete these tests prior to stacking о? STS-12. 
Questions concerning this memorandum should be referred to Mr. Leon Ray, 3-3809. 
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< Ss іе 
ЕР01 (85-38) March 7, 1985 
то: 5441/Мг, Mulloy 
THRU: EE11/Mr. Horton ЖС 
FROM: EPO!/Mr. McCool 


SUBJECT: Request for Initiation of Testing to Provide Data for Resolving 
the Burned O-Ring Seal Problem on the Space Shuttle SRM 


Letter EP25 (83-119), from Mr. Miller (ЕР25) to Mr. Horton (ЕЕТ1), subject: 
"Request for Tests by the Contractor to Obtain Space Shuttle SRM Clevis 
Joint, Field Housing/Aft Segment Joint and Ignition Adapter/Forward Segaent 
Joint Leak Check Data" 13 referenced. | 
On December 6, 1983, this office requested via the referenced letter that 
the contractor obtain available full scale diameter, short stack hardware 
and conduct tests to provide data on 2100 chromate putty behavior as related 
to affect on joint leak checks. Fourteen months have elapsed amd no visible 
action has been taken to obtain and equip the short stack hardware although 
agreement was dade to perform the test at the time of request. The only 
positive response by the contractor was the submittal of TWR-14359 on May 4, 
1983, which contained a program plan followed by 5-inch CP motor tests, 
which were not designed to provide a solution to the burned O-ring problem. 
The acquisition of joint putty layup and leak check data on a high priority 
basis has become very important in view of the need to resolve the burned 0- 
ring problems; accordingly, it is requested that you take the necessary 
action to direct that the following tasks ^e expeditiously performed by the 
contracto": 


a. Subscale and full scale tests to determine effects of asbestos 
filled, cotton and tale filled, and non-filled zine chromate putty on O-ring 
sealing integrity. 

b. Full scale tests: 

(1) Putty layup tests using current layup design. 
(2) Putty layup tests using the attached figure 1 layup concept. 


(3) Putty layup tests using the attached figure 2 layup concept. 
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(ЦУ Repeat tests (1) and (2) except with vent slots located at 120- 
degree interval around the circumference as shom by attached figures 3 
and 4. The slots are designed to prevent air entrapment апа resulting 
volcanoes. Evaluation of layup effectiveness should be perfo-med with flow 
meters to determine cavity volumes. 
The above tasks are intended to complement TWR-14359 rather than replace the 
tests defined therein. We will be happy to assist the contractor in working 
out the details for the above proposals. 


МЕЧА е. Cou N 
А.А. McCool 


Director 
Structures and Propulsion Laboratory 


Enclosures: 
Аз stated 
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5А42/Меззгз. McIntosh/Denton 
EE11/Mr. Coates 

EE11/Mr. Jones 

EP21/Mr. MeCarty 

EP25/Messrs. Miller/Powers/Ray 
ЕЕО1 /Dr. Littles 
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ЕР25 (84-15) February 22, 1984 
TO: EE11/Mr. Horton 

FROM: EP25/Mr. Miller 


SUBJECT: | Inspection of Fired SRM Pressure Joint During Disassembly 


Please take the necessary action to reinstate detail post flight and post 
static firing inspection of specific pressure joints on the SRM which incor- 
porate the thermal barrier and O-ring seal design concept. The inspection 
must be conducted at the time of disassembly to preclude destruction of 
data. The task should be performed by experienced, qualified engineering 
personnel and should be continued until the burned O-ring problem 15 under- 
stood and resolved. 


The incidence of heat damaged O-rings оп STS-2, QM-4 and on the recent 
flight of STS-11 warrants close surveillance of these areas to ensure that 
suspected anomalies are detected and properly recorded for assessment pur- 
poses. Recent discovery that the new type II zinc chromate sealant (thermal 
barrier material) would not adhere to the nozzle surface to which it was 
being applied, has opened up several unanswered questions, the most impor- 
tant being adhesion life of the sealant after installation on the SRM. Type 
ЇЇ zinc chromate sealant was installed on all SRM's beginning with STS.8. 


Areas of concern which warrant inspection are: 
a. SRM case field joints. 
b. SRM case nozzle boss to nozzle fixed housing joint, 
c. SRM igniter to SRM case igniter boss. 


. Nozzle field splice joint. 
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Interoffice Memo 


1 October 1985 
E150/RVE -86-47 


ТО: А. J. McDonald, Director 
Solid Rocket Motor Project 


FROM: Manager, SRM Ignition System, Final Assembly, Special 
Projects and Ground Test 


СС: B. McDougall, В. Russell, J. McCluskey, D. Cooper, 
J. Kilminster, B. Brinton, Т. O'Grady, D. MacBeth, 
J. Sutton, J. Elwell, І. Adams, Р. Call, 9. Lamere, 
P. Ross, D. Fullmer, E. Bailey, D. Smith, L. Bailey, 
B. Kuchek, Q. Eskelsen, P. Petty, J. McCall 


SUBJECT: Weekly Activity Report 
1 October 1985 


ЕХЕСИТФУЄ SUMMARY 


HELP! The seal task force is constantly being delayed by every possible 
means. People are quoting policy and systems without work-around. MSFC 
is correct in stating that we do not know how to run a development 
program. 


GRCND TEST 


1. The two (2) GTM center segments were received at T-24 last week. 
Optical measurements are being taken. Significant work has to be done 
to clean up the joints. It should be noted that when necessary SICBM 


takes priority. 
2. The 0M-6 test report less composite section was released last week. 


ELECTRICAL 


As а result of the latest engineering analysis of the V-1 case it 
appears that high stress risers to the case are created by the phenolic 
OFI housings and fairings. As it presently stands, these will probably 
have to be modified or removed and if removed will have to be replaced. 
This could have an impact on the launch schedule. 


ТС 2016 Riy 7-00) 
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А. J. McDonald, Director 
і October 1985 
Е150/ВУЕ-86-47 

Page 2 


FINAL ASSEMBLY 


One SRM 25 and two SRM 26 segments along with two SRM 24 exit cones were 
completed during this period. Only three segments are presently in 
work. Availability of igniter components, nozzles and systems tunnel 
tooling are the present constraining factors in the final assembly area. 


IGNITION SYSTEM 


l. Engineering is currently rewriting igniter gask-o-seal coating 
requirements to allow minor flaws and scratches. Bare metal areas will 
be coated with a thin film of HD-2 grease. Approval is expected within 
the week. 


2. Safe and Агт Device component deliveries 15 beginning to cause 
concern. There are five S&A's at KSC оп the shelf. Procurement, 
Program Office representatives visited Consolidated Controls to discuss 
accelerating scheduled deliveries. CCC has promised 10 A&M's and 30 
B-B's no later than 31 October 1985. 


O-RINGS AND PUTTY 


1. The short stack finally went together after repeated attempts, but 
one of the o-rings was cut. Efforts to separate the joint were stopped 
because some do not think they will work. Engineering is designing 
tools to separate the pieces. The prints should be released tomorrow. 


2. The inert segments are at T-24 and are undergoing inspection. 


3. The hot flow test rig 15 in design, which is proving to be 
difficult. Engineering is planning release of these prints Wednesday or 
Thursday. 


4. Various potential filler materials are on order such as carbon, 
graphite, quartz, and silica fiber braids; and different putties. They 
will all be tried in hot flow tests and full scale assembly tests. 


5. The atlegiance to the o-ring investigation task force is very 
limited to a group of engineers numbering 8-10. Our assigned people in 
manufacturing and quality have the desire, but are encumbered with other 
significant work. Others in manufacturing, quality, procurement who ere 
not involved directly, but whose help we need, are generating plenty of 
resistance. We are creating more instructional paper than engineering . 
data. We wish we could get action by verbal request but such is not the 5 
case. This is a red flag. . 


R. V. Ebeling wn 
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бару o Am of EP25 (79-23) February 6, 1979 ` 


ТО: Distribution 
FROM: ЕР25УМг. Ray - 


SUBJECT: Visit to Precision Rubber Products Corporation and ! 
Parker Seal Company , 


The purpose of thís memorandum is to document the results of a visit 

to Precision Rubber Products Corporation, Lebanon, TN, by Mr. Eudy, ЕЕ51 and 
Mr. Ray, EP25, on February 1, 1979 and also to inform you of the visit 

made to Parker Seal Company, Lexington, KY on February 2, 1979 by Mr. Вау." 
The purpose of the visits was to present the O-ring seal manufacturers 

with data concerning the large O-ring extrusion gaps being experienced on 
the Space Shuttle Solié Rocket Motor clevis joints and to seek opinions - 
regarding potential risks involved. ; : 


The visit on February 1, 1979, to Prectsion Rubber Products Corporation 
by Mr. Eudy and Mr. Ray was very wel] received. Company officials, Mr. 
Howard Gillette, Vice President for Technical Direction, Mr. John Hoover, 
Vice President for Engineering,and Mr. Gene Hale, Design Engineer 
attended the meeting and were presented with the SRM clevis joint seal 
test data by Mr. Eudy and Mr. Ray. After considerable discussion, 
company representatives declined to make immediate recommendations because 
of the need for more time to study the data. They did; however, voice 
concern for the destgn,stating that the SRM O-ring extrusion gap was 
larger than that covered by their experience. They also stated that more 
tests should be performed with the present design. Mr. Hoover promised 
to contzct MSFC for further discussions within a few days. Mr. Gillette 
provided Mr. Eudy and Mr. Ray with the names of two consultants who may 
be able to help. Ме are indebted to the Precision Rubber Products 
Corporation for the time and effort being'expended by their people. ín 
support of this problem, especially since they have no connection with 
the project. . 


The visit to the Parker Seal Company on February 2, 1979, by Mr. Ray, | 
EP25, was also well received; Parker Seal Company supplies the O-rings 
used in the SRM clevis joint design. Parker representatives, Mr. 8111 
Collins, Vice President for Sales, Mr. М. B. Green, Manager for Technical 
Services, Мг. J. М. Kosty, Chief Development Engineer for R&D, Mr. 

D. P. Thalman, Territory Manager and Mr. Ditch Haddock, Technical 
Services, met with Mr. Ray, EP25, and were provided with the identical 
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SRM clevis joint data as was presented to the Precision Rubber Products 
Company on February 1, 1979. Reaction to the data by Parker officials 

was essentially the same as that by Precision; the SRM rn) extrusion 
gap is larger than they have previously experienced. They also expressed 
Surprise that the seal had performed so well in the present application. 
Parker experts would make no official statements concerning reliability 
and potential risk factors associated with the present design; however, 
their first thought was that the O-ring was being asked to perform beyond 
fits intended design and that a different type of seal should be considered. 
The need for additional testing of the present design was also discussed 
and it was agreed that tests which more closely simulate actual conditions 
should be done.. Parker officials will study the data in more detail with 
other Company experts and contact MSFC for further discussions in 
approximately one week. Parker Seal has shown a serious interest in 
assisting MSFC with this problem and their efforts are very much appreciated. 


William L. Ray 
Solid Motor Branch, EP25 


Distribution: 
SA41/Messrs. Hardy/Rice 
EESI/Mr. Eudy 

ЕРО1/Мг. McCool 
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* This letter is written то “insure that —— is fully avare of tbe 
: seriousness of the ‘current — — — in. tha SRM — ш an 
AS engineering standpoint." [E MAS re ыы ” 
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The "mistakenly accepted position ou tha: Joint "problem was to o Бу witbout fear 
of failure and to run a series of design evaluations which would ultimately 
lead to a solution or at least a significant reduction of the erosion problem. 
This position is now drastically changed as a result of the SRM 16A nozzle 
joint erosion which eroded а secondary O-Ring with the primary O-Ring never 


sealing. 


ТЕ the same scenario should occur in a field joint (and it could), then it is 
з jump ball as to the success or failure of the joint because the secondary 
O-Ring cannot respond to the clevis opening rate and may not b^ capable of 
pressurization. -The result would ра а Caray өрнө of the highest order - 
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‘An unofficial team "(a memo afin the team and its purpose was never 
published) with leader was formed on 19 July 1985 and was tasked with solving 
. the problem for both the short and long term. This unofficial team is 
essentially nonexistent at this time. In my opinion, the team must be 
officially given the responsibility and the authority to execute the work 
.that needs to be done on а — —— basi: (full time assigament until 


| completed). О M. 
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shall not exceed 0.5 psig saxisus at а Lcil-cff rate cf 2.9 
lb/sec. The Hg vent systes sball not interface with tae Crbiter 
but shall теве directly to асвовгһесе in flight. Іо addition to 
providing ET relief protections, the veat valves shall be capable 
Of being actuated open, prior to launch, by ground comsand. The 
electrical cossand and pneumatic supply will be рготідед ty GSP. 
Capability shall be provided to scnitcr the sain propulsion 18: 
systems gcresseure when vebicle or grcund power is not applied to 
the flight iastroseats. 


3.2.2.1. 16 Мз бана. Any saterial used internally ia 
the liquid oxygen systes of the Space Shuttle Systen saia 
propulsion subsysteas shail be coajatible as deterained Бу NEB 
8060.1. i 


3.2.2.1.17 Resign Іртірорвєвів- 


3.2.2.1.17.1 "3C TINI aT ID." The Shuttle Plight Теһісіе 
— shell satisfy the natural envircagent design requireseats 
specified in apgeadix 10.10. 


3-2. 2. 1. 17. 2 1883594 лз e Rach element of the Shuttle 
— рІіаре Vehicle sha е capable i withstanding the induced 


environments imposed ducing traasportatíca, ground operations, 
handling and flight operations as defined ia Apresdixz 10.11. 
Rach interface betveen 81688215 shall be designed to withstand 
the induced environments defined ів tbe appliícarle ICD. 


3.2.2-1-17.2.:1 Азсер% Маз i РА јара. In севегаї, all 
elenents of the Space Ht е Mis ui е 44415844 «с 
withstand limiting induced ascent aercdysasic and pluse beating 
enviroaBents, encompassing all baseline refereace missions. The 
Crbiter vehicle fcr which lisit ascent aerodysasic heating 
environseats coupled sith reuse criteria vould result із 
unnecessary weight and cost penalties, shall be designed to веет 
reuse requiresenats consideriag the treguescy of cccurance of tbe 
ascent heating environsents resulting fros statistical treatsent 
of the L:s9l1ine гебесевсе 81581084 ead shall be showa tc bave 
single-si.».:a survivability tor 11816 ascent аегодувавіс heating 
case encouatered om any 8155108 duriag the lifetiae of the 


vehicle. The applicable eavircnosests аге defined in Appendix 
10.11. 


3.2.2. 1- 12.3 НЕН; All TES saterial авд installaticn 
design Shall ainisize absorption and entrapment of liquids or 
gases vhich vould degrade thersal or physical performance or 
present а fire hazard (wicking), ава shall not require draining, 


drying ос any dedicated purge systes írom refurbtishsemt tbrough 
launch. 


3.2. 3. 1. 18 [19а ladys 1558455. àll flezible bcses and 
© bellows shall ce designed to exclude cr 81018116 flou induced 


Refer to the Deviation/Naiver Fage ів frcat cf the document. 


3-40 


297 


8.0 БЕТЕСВОІ0. 1046 зрасе ьочосалє апада as Мары yutu ave we uuu ~ 
а 0.95 protabilty of во penetration during the вахівча total tiae 
for 500 sissions in orbit, using the seteoroid sodel defined in 
Section 2.5.1 ої 181-64%627. 


8.1 BETECROID IMPACT. Space Shuttle seteoroid isract 
теччігевеоея shall be specified below: 


а. 11080 :01:4.188 . The Space Shuttle sanned volase shall be 
Frotected trom seteoroid infact damage which would 
result ín pressure loss when subjected to the seteoroid 
flux model as defined in 71521-64627. 


Ї ад БАРАРА. The Space Shuttle shall provide 
dii On against loss of fuactiosaal capability of 


selected critical itess vvhen subjected to the setecroid 
flux model as defined із ТВІ-64627. The probability cf 
no pemetration shall be assessed on each ites dependent 
аров fuaction criticality. 


9.0 ASTBCDIKARBIC CONSTANTS. The values gives in Secticas 1.6 
and 2.7 of 18581-64627 shail be used. 


10.0  IHERBAL. 


19.1 сБСОМС TEZRMAL ЕНТІШСЕЗЕНІ. Тһе ground thermaal 

environsent, includiag air temperature, solar radiation, and sky 
tenperature limits, are specified ів Table 10.1-1 and Figure 10- == 
1. Also, sew Sections 2.5 and 2.6 of ТВІ-64757. 


10.1.1 ABLisnt Ieareratgre сос 338 Irorellant 14554585929 
Iiredictaásng- The appropriate KSC and ТАРВ monthly mean and 
ехсгеве aabient teaperatures listed below shall te used to 
establish SAB propellant temperatures and thrust ,erformance. 

The ісу and 51495 extremes are the 2.5 and 97.5 percentile average 
BODthly temperatures. 


10. 10-=4 | © 
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Table 10.1-1 


Ground Thersel Bavircasest 


pt ~ <<) О ООН aa ص‎ UD а ва, 
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2.23 
2.5.3.4 Solar Radiation during Extreme Conditions 


When ground winds ccour exceeding the 95, 99, or 99. 9 percentile 
design winds gives in this document in Section V, the associated weather 
normally is such that clouds, rain, or dust are generally present; therefore, 
the intensity of the incoming solar radiation will be less than the maximum 
values given in Tables 2. 3 and 2.4. Maximum values of solar radiation inten- 
sity to use with corresponding wind speeds are given in Table 3. 5. 


TABLE 2.5 SOLAR RADIATION MAXIMUM VALUES ASSOCIATED 
WITH EXTREME WIND VALUES 


2:6 Temperature === 


Several types of temperatures at the earth's boundary layer may be 
considered in desiga. These are as follows: | 


а. Air temperature normally measured at 1. 23 meters (4 ft) 
above a grase surface. 


b. Changes of air temperature (Usually the rapid changes which 
occur in less than 34 hours are considered. ) 


с. Gurface or skin temperature measured of a surface exposed 
to radiation, 


4. Temperatures within а closed compartment. 
All of the above will be discussed in the following subsections. 


® 
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2.6.1 Air Temperature Near Ше Surface 


Surfaco air tomporature extremes (maximum, minimum, and the 95 
percentile valuva) and the охігото minimum sky radiation (equal to tho oul- 
going radiation) аго givon іп Table 2.0 for various goographical агсан. Max- 
imum and minimum tumperalure values should bo expucted (о lust only а few 
hours during а daily period. Genvrally, tho maximum temporature is reached 
aftur 12 noon and ого 5 р. m., while tho minimum temperature ів reachod just 
before sunrise. Tablo 2. ТА shows tho maximum and minimum air tomperatures 
which have occurred on each hour at Kennedy Space Centor, but not nocessarily 
оп the same day, although those curvos ropresont a cold and hot oxtromo day. 
The method of sampling the day (frequency of occurrence of observations) wil! 
result in the same extreme values if the same peried of time for the data is 
used, but the 96 percentile values will be different for hourly, daily, and 
monthly data reference periods. Solection of tho reference period depends on 

engineering application. Tablo 2.7B givos month mean tompornturos, standard 
deviations and 2.5 and 97.5 porcontilcs of values of tomporsturo for Konnedy 
Space Conter, Florida and Vandenberg AFB, California. 


2. 6.2 Extreme Air Temperature Change 


а, For all areas the design values of extreme air temperature 
changes (thermal shook) are: 


(1) An increase of air temperature of 10°C (18°F) with a 
simultaneous incresse of solar radiation (measured oa а sormal surface) from 
0. 50 g-cal ста"? mia”! (110 BTU ft^! hr“) to 1. 85 g-cal om”? тіп”! (410 BTU 
ft! he!) may occur ів а i-hour period. Likewise, the reverse change of the 
same magnitude may ccour for decreasing air temperature and solar radiation. 


(2) A 24-hour chango may occur with an increase of 27.7" С 
(50* Р) in air temperature in а S-hour period, followed by 4 hours of coa- 
stant air temperature, thea a decrease of 27. T* C (50°F) ша S-hour period, 
followed by 10 hours of constant air temperature. 


b. Рог Eastera Test Range ( Kennedy Space Center ), the 99. 9 
percentile air temperature changes are as follows: 


— — (1) An increase of air temperature of 5. 6*C (11°F) with a 
simultaneous increase of solar radiation (measured on а normal eurface) from 
0. 50 g-cal ста"? пив”! (110 BTU ft^! аг!) to 1. 60 g-cal cm”? тіл”! 
(354 BTU ft^! hr“), ог a decrease of air temperature of 9. 4*C атр) with 
а simultaneous decrease of solar radiation from 1. 60 g-cal ст”? min"! 
(354 BTU ft^! hr!) to 0, 50 g-cal ст”? min”! (140 BTU ft! г") may occur 
in a 1-hour period, @) 
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TABLE 2.7 MAXIMUM AND MINIMUM SURFACE AIR TEMPERATURES 
AT EACH HOUR FOR EASTERN TEST RANGE‘ 


Р 
В 


© -зе (ль се м = 


м 
84 
` 85 
83 
83 
88 
87 
87 
89 
93 
96 
96 
` 99 
97 
97 
` 
97 
95 
93 
83 
84 
es 
56 
88 


4. Based ой 10 years of record for Patrick Air Рогов Base and 
: Kennedy Space Center. 
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2.0 APPLICABLE LOCUNZENTS. The below listed docusents fora a 
part of this appendix to tbe eztent specified herein. These 
docusents shall be individually apprcved as baseline 
requirements. The "Currest 15806" of each document вау be 
determined froa JSC 08102, Space 58860616 Program Level II 
Easeline Description and Status Бероге. 


Soptractos. 8882 0018 


5073-5Н-0069-1 
(Current Issue) 


5073-58-0069-2 
(Current Issue) 


5073-58-0069-3 
(Current Issue) 


5073-58-0069-4 
, (Current Issue) 


573-58-0181-1 
(Curreat Issue) 


5073-58-0181-2 
(Current Issue) 


5073-58-0181-3 
(Current Issue) 


Structural Design Loads Data Боск, 
Baseline Vebicle and 81581005 


Ref. Para. 3.3, 3.3.1, Table 10.11.1 


Orbiter Structural Design Loads гаса 
Book УУ: 


Ref. Раса. 3.3, 3.3.2, Table 10.11.1 
Stractural 068108 10448 Data Еоок, 
Ezxtersal Zaak 

Bef. Para. 3.3, 3.3.3, Takie 10.11.1 
Structural Design Loads Data Book, 
Solid Rocket Bcosters Structural 
Loads 

Ref. Рага. 3.3, 3.3.6, Table 10.11.1 
Aerodynamic Beating Data Book, 
Orbiter - Ascent (Есока I, ІІ and III) 


Bef. Para. 3.1, 3.1.1, Table 10.11.1 


Aerodynamic Heating Data Book 
Bzternal Tank - Asceat (Books I aad II) 


Ref. Para. 3.1, 3.1.1, Table 10.11.1 


Aerodyasmic Beating Data Book, 
Shuttle Vebicle Bccster - Asceat 
(Books I авд II) 


Bef. Рага. 3.1, 3.1.1, Table 10.11.1 


10.11-6 О, 
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5573-58-0181-4 вегодувавіс Heating Data Book, Space 
(Current 15846) Shuttle sain Engine 


Bef. Para. 3.1, 3.1.1, Table 10. 11.1 


5073-58-0181-5 ћегодувавјс Beating Data Book, 
(Currest Issue) Shuttle Launch Facility 


Bef. Раса. 3.1, 3.1.1, Table 10. 11. 1 


$273-$5-0183-7 зегодувавіс Beating Data Book, 
(Current Issue) Lightweight External Tank-Ascest 


Ref. Para. 3.1 


SD74-58-0082 Acoustics and Shock Data Book, 
(Current Issue) Space Shuttle Systes 


Bef. Para. 3-4, 3.5, Zable 10.11.1 


5074-58-0144 Thermal loterfaces Design Data Pcok = 
(Current issue) 


Ref. Para. 3.2, Table 10.11.1 


10. 11-7 (8) 
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А Rockwell international 
Specs Онол 


1.0 INTRODUCTION 


1.1 SCOPE 

Contained herein are the thermal design data required to complete the 
thermal interface definitions for the following interface control documents 
(ICD's): 


ICD 2-12001 Orbiter Vehicie/External Tank 


ICD 2-14001 Orbiter Vehicle/Solid Rockat Booster 
ICD 2-24001 External Tank/Solid Rocket Booster 
ICD 13M-15000 Space Shuttle Orbiter Vehicle/Main Engine 


1.2 APPLICABLE DOCUMENTS 


The natural environments that have an effect on the thermal design are 
defined in the following documents: 


JSC 07700, Space Shuttle Flight and Ground Systems Specification, — — — 
Volume X, Appendix 10.10, Natural Environment Design Requirements. : 


NASA TM X-64795, Distribution of Eight Meteorological Variables at «—— — 
Cape Kennedy, Florida, and Vandenberg Aír Force Base, California; 
Marshall Space Flight Center (dated November 19, 1973). 


The induced environments applicable to the Shuttle system elemants per- 
forming as part of the integrated flight vehicle are defined in the following 
data books: 


SD 73-SH-O181-1A, Space Shuttle Aerodynamic Heating Data Book -Orbíter 
Ascent, Volume I (dated February 1975) 


SD 73-SH-0181-2, Space Shuttle Aerodynamic Heating Data Book ~ External 
Tank Ascent, Volume 11 (dated June 1976). 


SD 73-5Н-0183-3, Space Shuttle Aerodynamic Heating Data Book-Shuttla 
Vehicle Booster Ascent, Volume III (dated Septanber 1976). 


SD 73-SH-0181-4, Space Shuttle Aerodynamic Heating Data Воок ~ Space 
Shuttle Main Engine Ascent, On-Orbit and Encry, Volume IV (dated 
September 1977) 


These books form part of the Space Shuttle Flight and Ground Sygtans Specifi- 
cation, JSC 07700, Volume X, Appendix 10.11, Induced Environment Design 
Requirements. The induced environments data are available on magnetic tape 
records as specified in Reference 1 for the orbiter, Reference 2 for che 
external tank, and Reference 3 for the Shuttle vehicle booster. 


e 


1-1 
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Space Transseration System 6 % Rockwell 
Integration & Operanens датава International 
Space Sysieme Group 


2.4 SURFACE TEMPERATURE RESPONSES 


Surface temperatura responses are provided to establish che radiant sources 
and sinks for che Shuttle vehicle from prelaunch through ascent. These data 
are not to be construed as material temperature limits. They are intended as 
thermal interface daca required for elemenc chermal design analysis. 


2.4.1 Pralausch paee s 


The prelaunch, post-fill surface temperature histories are presented 
herein for the hot and cold day environments specified in the Space Shuttle 
Flighe end Ground Systems Specification, JSC 07700, Volume X, Appendix 10.10, 
Natural Environment Design Requirements. The 95th percentile day for July 
ас Cape Kennedy was used for the extreme hot day environment. Тог the 
extreme cold day environment, the Sth percentile day for January at Vandenberg 
Air Force Base was used. External tank fill vas assumed at 1100 hours for all 
Cases. 


2.5.1.1 Orbiter Vehicle 


The prelaunch environmental temperatures for the fuselage lover external 
surfaces (Zones Ol through 05, Figure 2.1-1) are presented in Figures 2.6.1.1-1 
through 2.4.1.1-4. Рот the wing leading edge (Zones 06 through 09, Figure 
2.1-1), the external surface temperature historias for prelaunch ага given in 
Figuras 2.4.1.1-5 and 2.4.1.1-6. The temperatura variations for the wing lower 
ахсагла1 surfaces (Zones 010 through 012, Figure 2.1-1) during prelaunch ате 
provided іп Figures 2.4.1.1-7 chrough 2.6.1.1-9. 


2.4.1.2 External Tank (ЕТ) 


Figures 2.4.1.2-1 through 2.4.1.2-3 provide the temperature response of 
the external tank surfaces defined in Figure 2.1-2 when subjected to a hot day 
prelaunch environment. The cold day prelsunch environment temperature varia- 
tions for che external tank surfaces (Figure 2.1-2) are presented in Fig- 
ures 2.4,1.2-4 through 2.4.1.2-6. The temperatures со be used for the ET 
crossbeam surfaces (Figure 2.1-3) are 98°F for hot day and 29°F for cold day 
prelaunch environments. 


2.4.1.3 Solid Rocket Booster (SRB) 

Temperature profiles for the SRB external surfaces defined ia Figure 2.1-4 
are provided in Figure 2.4,1.3-1 for the hot day prelaunch environment and 
Figure 2.4,1.3-2 for the cold day prelaunch envircament. 

. 2.4.1.4 Space Shuttle Main Engine (SSME) 


Hot day prelaunch envirtonmmantsl temperature histories for the Space 
Shuttle main engine interface envelope, defined in Figure 2.4:1.4-3, аге 
presented in Figure 2.4.1.4-1. The SSME сотрагспас: surface temperatures are 
given in Figure 2.4.1.4-2 for a cold day prelaunch environment. 


2415 


50 74-54-0140 
Мау 1979 
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95 Rockwell International 
-Speco Division 


3.2.3 Solid Rocket Booster 


Temperature extremes for the SRB side of the following conduction 
interfaces: | 


ET/SRB forward attachment (Figure 3.1.2-3) 
TI/SRB aft attachment (Figure 3.1.24) 
are presented in Table 3.2.3-1 for hot day (maximum) and cold day (minimum). 


Table 3.2.3-1. Solid Rocket Booster/External Tank Conduction 
Interface Temperatures--Prelaunch Eavirocment 


Hot Day | Cold Day 


Forward attachment, Location Ға 
Forward attachment, Location F 
Aft attachment, Locations Gg, Kg, and LB 


3.2.6 Space Shuttle Main sins 
Temperature histories for the SSME side of the following interfaces: 
LPFTP flange (Figure 3.1.1-3) 
LPOTP flange (Figure 3.1.1-4) 
Gimbal bearing (Figure 3.1.1-5) 
Баас shield attachment (Figure 3.1.1-6) 
ТҮС actuator attachment (Figure 3.1.1-7) 
ага presented in Figures 3.2.4-1 through 3.2.6-5. 
3.2.5 Mobile Launch Platform 


Maximum temperatures for the МІР side of the following condition 
interfaces: 


SRB/MLP hold~down support hardware (Figure 13.1.321) 
are presented in Table 3.2.5-1 | 


3-27 @ 
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Specification Мо, СРИ1-3300 


‘PRIME EQUIPMENT CONTRACT END ITEM 
DETAIL SPECIFICATION - 
PART 1 OF TWO PARTS 


— — PERFORMANCE, DESIGN AND VERIFICATION REQUIREMENTS 
SPACE SHUTTLE HIGH PERFORMANCE, SOLID 

ROCKET MOTOR LIGHTWEIGHT 

мезо 5 


0 
SPACE SHUTTLE SOLID 
ROCKET MOTOR PROJECT 
OPERATIONAL FLIGHT 
(513-8, 12 & Suds) 


— 


17 February 1904 


PENDING MASA АРНА 
ра но. 8-2 
PREPARED FOR 


NATIONAL AERONAUTICS AND SPACE ADHINISTRATION 
GEORGE С. MARSHALL SPACE FLIGHT CENTER 
MARSHALL SPACE PLIGHT CENTER, ALABAMA 35812 
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maintenance and refurbisngaent operations. 


3.2.6.3 Personnel Safety. Provisions for personnel safety shall 
ре in accordance with the following: 


8. Safety Devices. Know nazards which cannot be 
elisinated through design selection snall be 
reduced to an acceptable level through the use of 

.appropriate safety devices аз part of спе systea, 
Suosystea, or equipment. 


0. warning Devices. мпеге it is not possible to 
preclude the existence or occurrence of a Known 
nazard, devices shall be eaployed for the timely 
detection of the condition and tne geceration of an 
adequate warning signal. Warning sigrasls ard their 
application shall be designed to minimize the 
probability of wrong signals or of improper 
personnel reaction to the sigral. 


3.2.6.4 Explosive and/or Ordnance Safety. Tne propellants for 
tne nPML and tne igriter shall meet the requirements of hazard 
сізззіГісасіоп г as defined in the Army Material Согаал4 | 
Regulation Safety Manual AMCR 385-100, ог DoD Contractor's Safety 
Manual for КаФипісіоп, Expiosives, and Helated Dangerous 
Materials, DoD 4145,26. Tne HPML segments and ignition systea 
less асқары, shall nave а DoT explosive classification of 
Class B. 


(2.2.7 Environsent. 5) 
3.2.7.1 Natural Environment. Tne HPML shall withstand tne «emere. 
natural environments defined in JSC 07700, Volume X, Appendix 
10.10 and tne air and sea temperature environmerts and salinity 
ог 5Е-014-043-24., aye 


3.2.1.2 Induced Environment. Tne HPML shall withstand спе -e= 
induced environaental conditions as defined in tne following 
docunerts: = 


Тпега ај 
Base eating - 5073-5н-0181-3 
| Launch & Ascent - 3073-5H-0181-3 
Re-entry - SE-019-053-2H 
Interface - 3074-3Н-0144, ICD 3-44003 LIE TSS 
Loads NN 
Vibration, Acoustic з Snosk 5Е-219-049-2Н 
and SE-019-067-2H (аз cnanged by approved 
Deviation RD4-OO012R4) Іп case of confiict, SE-019-0u9-2H 
shall take precedence cve” 5Е-019-067-24. 
Prelaunch tnrough Separation « SE-019-057-2d, Book 1 @) 


64-420 0 - 86 - 11 
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IVLN TITLE: BASELINE MISSION CAPABILITY = = - eA 
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SCOPE OF ІМ 


Toe Вазе!:ре Mission Capability IVLM, as applicable to this vox, verifies those activitie 
asd interrelationships that apply to PMOP constraists. 615-1 flight perforzance bas 
bees evaluated by trajectory simulations utilizing propulsion tag values and specified 
$18 performance. In addiction to flight perforcance reserves god intact sbort, уау 
steering, insertion point accuracy, ET disposal and flight personne] loads bave been 
evaluated and found satisfactory for 515-1 flight. (See Continuation Sheet) 
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я М $ ME uM: A. Ёс, 
Rockwell international SPACE SHUTTLE SYSTEM / \© 
2% Space Systems Group INTEGRATED ELEMENTS М Л 
МЕВІРІСАТІОМ COMPLETION NOTICE 


2 РАСЕ Т. оғ. 2 
IVUN NO.: 12 VCM NO.: 12A21 


IVLN эё ОАТЕ: 001 2 7 1882 
CONSTAAINT: 025 


SCOPE ОҒ УМ 


This Baseline Mission Capability IVLN identifies the activities and interrelattonships 
occuring during the Orbital Flight Test phase of the program applicable to veriying the 
capability of the vehicle to perform the baseline 81551005 specified in the applicable 
paragraphs of J5C-07700-10. The verífication activities accomplished prior to t^e first 
flight are identified in VCN No. 12311... (See continuation sheet) : 
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INFORMATION REQUIREMENT CESCRIPTIUN 


| Title: |Туре імо. (Date Rev. 
| 


Failure Moce Effects Analysis 2 


FRR submittal. | 


Ёх 


hibit A, 3.3.3 - Encineering Succort 


Glo 


< 


interrelaticnsnip: 


ўсоре-сопсепс5-г оглас —Malntenance-Gavermment Purnisneg Data: 
Croiter Venicle Subsystem, including the following: 
із being conducted. 


individuals responsible for overall FMEA effort. 
с. Revision - Date individual pages ars revised. 
d. Item Identification: 


(1) Name 


module on the scnematic. 


| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
і 
І 
| 
| 
| 
| 
| 
| 
| 
| 
і 
і 
І 
| 
| 
І 
| 
| 
| 
| 
| 
| 
і and failure moce. 
| 

І 

| 

| 

| 

| 

| 

| 

| 


163 (1679a/C076a) 


| КА-26723 


(а) Quantity - Total пштсег of items in the subsystem. 


P. Рипстісп + Concise statement of t^e function per?ormea. 


To identify critical failure moces ta Бе used as a hasis for support ої: (1) 
Additional Design Action; (2) Safety Analysis; and (3) Mission Cantingency Planning 


1. Sccoe/Centants - Failure mode effects analysis will te prepared for each 
а. System/Subsystem/Assembly/Item - Icentificaticn of item for wnicn the FMEA 


9. Precareg/Approved dy - Identification of analyst wno performed the FMEA and 


(2) identificaticn Number ~ Orawing numoer by wnich the Ccntzactor 
icentifles and describes eacn component or mccule. 


(3) Drawing Reference Cesignaticn - Icenti?icaticn cf the component ог 


e. FMEA Number = A number that uniquely icentifies tne subsystem, czmponent, 


Page lof 3 


51581-060С8 


Sucmittal 3cnecule: 


Submit updates at 6month intervals with submittal linked to nearest schedule CIL 


| | 
Сопттасс 50и Reference 


ымен сос г 


—— — — — — —ñ —ñ ЕЕ ñ —ñ r ——— 


т РР — 


— — — — — — — — — — — — — — — — — ل — 
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INFURMATICN REQUIREMENT ОЕЄХСЯЇРТІСМ 


(1) The redundant elements are not cacaois of спесксис curing tne normal 
mission turnarcund sequence, СІ 


(2) Less of a secuncant element 17 ncc readily гесэстасіз су іле 01 ар: 
crew, ог й 


ғ 
(3) АШ recundant elements can зе lest sy а зілсіз 22841518 causa ог event 
such as contamination sv ахоіазісп. 


m. Ground Rules anc Assumccizn - Stectemant cf all groune rules зго sssumcticns 
followed curing tne performance cf FMES, 


Page 2 sf 3 


— —— — — — — —ñ — — — — — — — — — س‎ — — = 
| iicla: (ма. (Басе лем. | 
І | | | 
| Failure мссе Effects Analysis | АА-257=3 | 
| і 
| 
| 2.` Seece/Centents (Continued) | 
| | 
| 9. Failure Moce and Cause - icentificaticn of the scecific failure moce after | 
| ссп5ісегілд the four базіс failure conditicns: | 
і | 
| (1) Premature cperaticn. | 
| (2) Failure to срегаёз at а prescribed time. | 
| .. (3) Failure ta cease ccerzation at a prescrized tine. | 
| (а) Failure curing operation. | 
| | 
| For eacn гоојасабје failure mcce, ceserite the major cause(s) including 1 
|. cperational ana envizzrmental stress faccars, 17 кпсип. | 
| і 
і п. Missícn/Fhase ~ "паза of mission іл which failure occurs, 2.4., Prelaunch: | 
| checkout, ccuntcewn; Flight: 60555 chase, eartn orsit, etc. | 
. | 
| і. Failure Effect on - Subsystem, inter?acing subsystem, тіз5ісп/стти, element | 
| and/or venicle аз required. ! 
: | 
| 1. Failure Cetecticn Method - А сессгісбісп о? the nethcas by жпісл the | 
| failure cculd се cetected. 1 
| 
| К. Correcting Acticn - Ап ісепбіїісабісо of correcting action, automatic oz | 
| manual, wnicn would се taken со circumvent the ?ailuze.  Ircluce statement | 
| of alternate means o? срегасісп ana redundancy availacle after failure. | 
| | 
| 1. Failure Moce Cziticality Category Сеѕіспасісп = Catagerize the failure тосе | 
{ eziticality in relatizn ta стаж safely ага missicn еббаст. Incluce an | 
| ісепсіГісасісп af all 15зт5 not nesting recuncancy zscuizements curing | 
| intact асогоз. | 
і І 
| Equipment other than criticality 1 shall se further evaluated in accarcence | 
| with the recuncancy harcware screens Сезстісей 28128, А побасісп will се | 
1 mace identifying each screen tne пассиаге ссе5 mot pass. | 
| | 
| | 
| | 
| 
| | 
| | 
| | 
| | 
| | 
| | 
| | 
| | 
| | 
| | 
| | 
| | 

і 

: | 
| | 
| ! 
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INFORMATICN REQUIREMENT CESCRIPTICN 


INQ. ipata Rev. 


“ 


| 
Failure Мосе Effects Analysis | RA-267E3 | 


2. Sccoe/Contents (Continued) 


п. Remarks/Hazards = Statement of any remarks, recemmencations, and potential 
hazards as required. 


о. Vehicle Effectivity - Icentification of the vehicle effectivity for the 
fallure mode identified. 


3. Format - To бе prepared in Contractor's format. 
4. Maintenance - Та be maintained by pace revision/total reissuance, as applicable. 


5. Government Furnished Data - Not applicable. 


Pace 5 ә? 3 
ks хн лэл ээ 
(1679а/0076а) - 5Т381-06008 
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INFORMATION REQUIREMENT CESCRIPTICN 
| Title: |Туре ING. — Rev, | 
| | 


| 
| Failure Мосе Effects Analysis | 2 |ВБА-267:3 | | 
tral Scnecule: | 


| Submit updates at 6—nonth intervals with submittal linked to nearest schedule CIL 

| FRA submittal. _ 

| | 

| Contzact 55и Rererence: т> уу es x ES 


Exhibit A, 3.3.3 - Encineerina Succort 
Use: 


To identify critical failure modes to be used as a tasis Гог support of: (1) 
Additional Oesign Action; (2) Safety Analysis; and (3) Mission Contingency Planning. 


interzeiacicnsnip: 


ўсэре-сспсепсз-г ormat-—Malntenance-—sovermment rurnisneg Саса: 


1. Sccoe/Contsnts - Failure moce effects analysis will te prepared for each 
Oraiter Venicle Subsystem, including the following: 


а. System/Subsystem/Assembly/Item - Icentification of item for which the FMEA 
is being concucted. 
individuals responsible for overall FMEA effort. 

с. Revision - Date indivicual pages are revised. 

d. Item Identification: 
(1) Name 


(2) Identification Numoer - Orawing number by which the Ccntzactor 
identifies and describes eacn component or mccule. 


(3) Drawing Reference Cesignaticn = Icentification of the component or 
mocule on tne schematic. 


(4) Quantity - Теса] numcer of items Їл the subsystem. 


e. FMEA Number - A number that uniquely icentifies tne subsystem, compcnent, 
and failure тосе. 


г, Function - Concise statement of the functicn per?crmeg. 
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INFCRMATICN REQUIREMENT CESCRIFTION 


کے — سے سے — کے سے مت سے کے —— — — — — — — — — — — — — — — — — — — — — — — — کے — — — — — — — — — — — — — — — — — — 


б 


۶ 


сспзїагхїлд the four basic “Өүлэн cenditicns 


(1) Premature cperaticn. 

(2) Failure to cperate at a presesibed tame. 

(3) Failure t3 cease 51-0 ас а prescribed tine. 
(4) Failure curing срегасісп 


For eacn apolicanle failures лссе, сезссїБз the major cause(s) including 
cperational ana envizcrmental stzess ?actars, і? known. 


Missicn/Pnase + Fhase ОҒ missicn іп which failure occurs, s.g., Prelaunch: 
checkcut, ссилоссип; Flight: 5005: chase, earth orcit, etc. 


Failure Effect cn - Subsystem, intsr?acing subsyscem, missicn/crew, element 
and/or venicle as rzecuice4d. ы; 
Failure Cetecticn Metnod - А сестістісп of the netheas бу whicn the 
failure could te detected. 


Correcting Ассісп - Ап icenti?icaticn of correcting action, automatic ст 
manual, wnicn would се takan ts circumvent tre failure.  Incluce statemenc 
of alternate means ог срегасісп ала redundancy availanle after failure. 


Failure Moce Cziticality Categcz, Cesignatizn - Catsgcrizs t^e failure ncce 
criticality in relatisn ta craw safety ага missicn sffecc. Incluce ап 
icentivicaticn of all itams пос nesting cecuncancy zscuizements curing 
intact accrts. 


Equipment other than criticality 1 shall Бе further evaluated in accorzerce 
with the cecuncancy harcware screens Cescziced тсе124, А notacicn will 5 
mace icentifying васл screen tne naccware ссез not pass. 


(1) The гесигдалс elements аге nat сасаоіе of спесксые curing the погла! 
mission turznarcurd sequence, сг 


(2) Less of а zecuncant element 1? nct 283011) detecctacle sy the flignt 
crew , or * ЈЕ 
(3) All recuncant elements can се lost су а single стесізів causa 22 avent 


such аз contzminarticn 22 зхој2522П. 


тсига Rules ага Assumcticn - Statement cf all стосго rules ane assumeticrs 
з cf ҒчЕд, 


followed Curing the performance 
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INFCRMATICN RESUIREMENT OESCRIPTION 


| Title: іма. ібаса Rev. 
| | 
Failure Moce Effects Analysis | 8А-267Е3 | 
| 
2. 5сспе/Сспїгпй5 (Continued) 


п. Remarks/Hazards - Statement of any remarks, recommendations, and potential 


| 
| 
| | 
| hazards as required. 


о. Vehicle Effectivity ~ Identification of the vehicle effectivity for the 
failure mode icentified. 


3. Format ~ Та Бе aresared Їл Contractor's format. 
4. Maintenance - То be maintained by page revision/total reissuance, as applicable. 


5. Goverrment Furnished Data - Not applicable. 
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Date: January 31, 1984 

Раде 1 of 34 

Approved: 
RELIABILITY Ү.Р. Ostrander, 

Mgr., Reliability 
DESK INSTRUCTION Space Shuttle Ргодгає 

No. 100-26 у 


FLIGHT HARDWARE 
FAILURE MODE EFFECTS ANALYSIS (FMEA) 
реа ана т лы, з рын ee ee қасы 
CRITICAL ITEMS LIST (СП) 


аксон с аа абла а ЕР ЕВ EE TEE аы с ES ETERS‏ ڪڪ 
2-6.3.1 10 2.2 


(2) Reliability Desk Instruction Мо. 100-1 ~ Reliability 
valuation 


(3) Reliability Desk Instruction No. 100-12 - Shuttle 
Element Interface 


INTRODUCTION 


Reliability of the design is the ultimate responsibility of Design. However,’ 
it is incumbent on other Engineering functions, including Reliability, to support 
the design engineer іп discharging his responsibilities. The Failure Mode Effect 
Analysis (FMEA} 15 primary reliability technique for providing design and program 


support and constitutes a documented record of the design status and coordinated 
decisions. 


1.0 | PURPOSE 

This desk {instruction defines the procedures for generating, documenting and | 
maintaining Failure Mode Effects Analyses (FMEA) and Critical Items Lists (CIL) for 
the Space Shuttle Orbiter subsystems in order to verify design adequacy with 
respect to inherent reliability. i 


—-— 


2.0 DEFINITIONS 


1, Failure - 15 the inability of a system, subsystem, component, or part to 
perform its required function within specified limits under specified 
conditions for a specified duration. у 
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Failure Mode - a description of the manner in which an item can fail. 


Hazard - 15 the presence of a potential risk situation caused by an 
unsafe act аг condition. 222 


Redundancy (depth of) - describes the available (number of) ways of 
performing a function. 


Backup Mode of Operation - describes the available ways of performing a 
function utilizing "like" (identical) hardware. 


Alternate Mode of Operation - describes any additional ways of 
performing a function utilizing "unlike" hardware. 


Criticality - is the categorization of a hardware item by the worst case 

potential direct effect of failure of that item. In assigning hardware 

criticality, the availability of redundancy (backup or alternate) modes 

of operation is considered. Assignment of functional criticality, 

however, assumes the loss of all! redundant (backup or alternate) 

hardware clements. The definition of criticality is shown in Table 2.0. 
Table 2.0 - Criticality Definition 


CRITICALITY POTENTIAL EFFECT OF FAILURE 
1 ‘Loss of life or vehicle. 
2 | Loss of mission. 
3 All others. 
18 Redundant hardware element, all of 


which if failed, could cause loss 
of life or vehicle. 


2R Redundant hardware element, all of 
which if failed, could cause loss 
of mission. 


NOTE: See Appendix B, paragraph 3.1.1, 
Ground Rules, sub-paragraphs ! and 2. 


8. Single Failure Point (SFP) - is a single item of hardware, the failure 


of which would lead directly to loss of life, vehicle, бг mission. 
Where safety considerations dictate that abort be initiated when a 
redundant (tem fails, that item is also considered a single failure 
poínt. 
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9. Functional Mode - identifies each function to be performed by the item 
being analyzed. 


. 


10. Multiple Order Failure - describes the failure due to a single cause ог 
event of all units which perform a necessary (critical) function. 


11. Critical Item - a single failure point and/or a redundant element in a 
life or mission-essential application where: 
а. Redundant elements are not capable of checkout ӨЛЕН the парый 
ground turnaround sequence. 
СЬ. Loss of a redundant element is not readily detectable in flight. 
с. All redundant elements can be lost by a single credible cause or 
event such as contamination or explosion. 


12. Kit - For the purposes of this desk instruction, a kit 15 defined as a 
temporary addition or modification to the Orbiter or its SUDSy tens to 
satisfy unique requirements for a specific mission. 


13. Post Landing Safing Operations - For the purposes of this desk instruc- 
tion, post landing safing operations are defined as those activities 
performed after landing to prepare the Orbiter for hangar operations. 
This includes the deservice and draining of all hazardous fluids, safing 
of unused ordnance, application of ground power and cooling, removal of 
potentially hazardous components, pods and payloads, purging and venting 
of gases and the installation of protective covers. 


14. Prelaunch Operations - Prelaunch operations for propulsion subsystems 15 
defined as beginning with propellant loading for each specific 
subsystem. For ali other subsystems prelaunch operations commence with 
start of main engine conditioning. 


~ 


3.0 FMEA/CIL PREPARATION . 

FMEA's will be prepared jointly by the responsible designer and the assigned 
Reliability Subsystem Analyst (RSA) in accordance with the attached format, 
Appendix D (Ground Rules and Criteria) and as shown in FIGURE 1. Safety, other 
engineering disciplines, and technical support functions (see EOM Directive 
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70 2-6.3.1) will provide support as required. Where the FMEA deviates from the 
instructions and ground rules contained herein, appropriate notation will be 
included within the "Ground Rules and Criteria" of the FMEA preface. 


3.1 SCHEDULE 
' Reliability, in coordination with Design, will define the schedule and depth 
of detail for each FMEA to be prepared for the Orbiter in support of contractual 
requirements, and issue an FMEA schedule. 
3.2 CONTENT 
5 Each subsystem FMEA/CIL shall be prefaced by the following information, 
sequenced as indicated:. 
1.0 INTRODUCTION 
2.0 QUALITATIVE RELIABILTY SUMMARY 
. 2.1 SUBSYSTEM DESCRIPTION AND EFFECTIVE DATE 
2.2 SIGNIFICANT UNDEFINED DESIGN AREAS 
2.3 CRITICAL ITEMS SUMMARY 

3.0 GROUND RULES AND CRITERIA 

4,0 DISPLAYS AND CONTROLS INDEX 

5.0 LIST OF REFERENCE DOCUMENTS 

6.0 SCHEMATICS 
The backup information, including rationale and anaylses involved in assessing 
failure modes and their effects, generally 15 not included in the final FMEA and 
CIL package. Where such information exists in the form of notes, calculations, 
IL's, references and other similar material, it will be retained by the responsible 
RSA. Should the RSA be reassigned, he will turn over the material to his 
supervi sor. 


3.3 ANALYSIS REQUIREMENTS 

1. FMEA's will be performed for each functional mode of a subsystem or 

- functional kit. Electrical FMEA's will be conducted to the "black box" 
level and within the "black box" to pursue functions which have single 
failure point potential effect on the orbiter safety or mission 
success. The level of detail required in mechanical FMEA's below the 
component level in pursuit of critical failure modes will vary. 
Standard design, such as check valves, relief valves, isolation valves, 
etc., require only common types of failure causes to be listed. 
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EXAMPLE: Failure Mode - internal /external leakage. 
Cause - poppet/seat damage, contamination, 
structural failure. : 
When a component 15 a non-standard type of design ог is unique in 
application or contains unusual /unique failure modes of a critical 
nature, a more detailed analysis is required. Piece parts and their 


failure modes and effects that could result in component critical 


failure modes must be identified and included ín the "CAUSE" section of 
the component FMEA for each component failure mode of concern. 
EXAMPLE: Spring - fracture, structura] failure - poppet 
й fails to seat. 


FMEA's for mechanical systems and avionics will interface at the 
connector. (See section 4.3.4, Mechanical /Electrical Interface.) 


All identified failure modes will be assigned two criticalities 
(functional and hardware) based on the definitions іп section 2.0, 
Definitions, and procedures contained in sections 4.3.1 and 4.3.2, 
Hardware and Functional Criticality Determination. 


The criticality assigned to pressure carriers (pressure lines and 
vessels) shall reflect the worst case failure effect. These include 
potential shrapnel damage to the vehicle/subsystems resulting from 
rupture of non-filament wound ‘tanks, potential overpressurization caused 
by releasing substantial quantities of fluids from ruptured lines or 
tanks, or depletion of consumables. Where released fluids are flammable 
or oxidizers and the possibility of an ignition source exists, 
appropriate notation will be entered under "HAZARDS" for Safety action. 
(See Appendix B, paragraph 3.1.1, Ground Rules, subparagraphs 13, 14, 
and 15.) 


Failures which could occur during all mission phases from prelaunch 
through deactiviation (including safing & purging) of subsystems 
subsequent to landing and during ferry flights shall be-considered, 
regardless of occurrence probability. Documentation of prelaunch 


analysis is required only for items classified as criticality 1/1. 
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6. All ordnance/pyrotechnic items will be listed in the CIL according to 
the most severe effect (criticality 1 or 2) of a premature operation. 
7. Each hardware or function critical item summary will include a count of 
the total number of critical failure modes per item, by criticality, | 
classified either structural or functional (see paragraph 4.1.11). 


8. Critical item summaries for kits will be included, but identified 
separately. 


9. FMEA's will not be required on structures, wire harnesses, cables and 
electrical connectors. For all critical circuits where a short between 
adjacent connector contacts could reslut in loss of crew (MSC D&P 
Standard No. 32), the design schematics shall be reviewed to verify that 
this condition does not exist. The incorporation of a switch on the 

. ground side that precludes an adjacent contact short to result in crew 
loss is considered acceptable for meeting the MSC D&P Standard No. 32 
requirement. 


For all other critical circuits, separation of redundant functions will 
be verified by selective review of design schematics to insure that the 
requirements for separation have been incorporated and complied with. 


10. Logic diagrams (ref. Desk Instruction 100-1, Reliability Evaluation) 


will be developed only where required to provide proper correlation 
between schematics and FMEA's. 


11. Those components that are criticality 3 (functional and hardware) іп the 
electrical circuits by "black box" criticality may be listed on one FMEA 
for for that circuit. Those components that are hardware criticality 1 
or 2- will have individual FMEA's. Those components that are criticality 
18 or 28, and appear in the CIL, will have individual FMEA's. 


4.0 IMPLEMENTATION : 


A program has been developed to provide computer printout of FMEA and CIL 
data. Format examples of these printouts are shown in FIGURES 2 and 3. The 
following section contains instructions for documenting the FMEA. Data entry 
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sheets (FIGURES 4 and 5) will be completed by the RSA as information becomes 
available. The information will be entered into the computer and the RSA will 
receive a copy of the resultant data printout (FIGURES 6 and 7) which will comprise 
a working document of the information stored in the computer and a baseline for 
additional inputs or revisions. 


4.1 DATA ELEMENTS 

The following procedure describes the information to be filled out on Data 
` Sheets 1 and 2 (FIGURES 4 and 5). Each data descriptor is preceded by the entry 
code for that item (e.g., LY1, Subsystem ID). These codes also are shown on the 
examples of the FMEA and CIL formats, FIGURES 2 and 3, for information. 


DATA SHEET NO. 1 


4.1.1 (DI, LYI, 142) DATA IDENTIFIER: This line uniquely identifies the component 
being analyzed and the "update" information to be taken. 

a. Circle "A", "R" or "D" to indicate appropriate action -- 

А - Add а new record (component or assembly). 
R - Review an existing record by adding, deleting, or 
revising an element(s) of that record. я 
D - Delete an entire record and all information іп that 
record. 

b. SUBSYSTEM ID (LY1): Enter the last two digits of the applicable 
designator and dash number. (See TABLE 4.0). 

c. COMPONENT ID (LY2): Enter a number which uniquely identifies the 
particular component being available. 16 an existing schematic 
identifier is available, 1t may be used. For computer printout 
purposes, the first digit(s) of the number shall be selected to indicate 
the assembly. The use of special characters such as periods or dashes 
will be avoided. 


— 


4.1.2 (01) ASSEMBLY NAME: Enter the name of the assembly. . 


4.1.3 (Ci, 41) ITEM NOMENCLATURE: Enter the nomenclature for the Component. In 
the first block (C2), give the basic identifying noun. Enter any additional 
modifiers or description on the Jl line. A typical example is “Valve, 
Solenoid", where "valve" 15 the basic identifier. | 
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Table 4.0 - IDENTIFIERS 4 SUBSYSTEM NAMES 


01-5 
02-1 
02-2 
02-3 


PURGE, VENT & DRAIN 
LANDING DECELERATION 
DOCKING MECHANISM 
SEPARATION MECHANISM 
ACTUATION MECHANISMS 
02-4 DOORS 
ET Umbil door 
Star Tracker 
Air Data Sensor 
02-4A HATCHES 
02-48 PAYLOAD ВАХ DOORS 


` 02-4С RUDDER/SPEEDBRAKE, 
. BODY FLAP 


PAYLOAD RETENTION/DEPLOYMENT 
‘MECHANISMS 


HYDRAULICS 

MAIN PROPULSION 
REACTION CONTROL 
03-2A AFT 
03-28 FORWARD 


ORBITAL MANEUVER 


04-1 ELECTRICAL POWER - CYRO 
04-1А ELECTRICAL POWER - FUEL CELL 


04-2 AUXILIARY POWER (APU) 


05-1 


GUIDANCE, NAVIGATION & CONTROL 


COMMUNICATIONS & TRACKING 


05-2А 
05-28 
05-2С 


. 05-20 


05-22 
05-26 
05-29 
05-2К 
05-28 


05-3 
05-4 
05-5 


*05-6 


05-8 
06-1 


TACAN . 

ALTIMETER 

MICROWAVE SCAN BEAM LANDING (MSBLS) 
5-8АНО 

PAYLOAD INTERRAGATOR 

CLOSED CIRCUIT TY (TV) 

KU-BAND COMM & RADAR 


DISPLAYS & CONTROLS 
INSTRUMENTATION 


DATA PROCESSING & SOFTWARE 
& COMPUTERS 


ELECTRICAL POWER DISTRIBUTION 
& CONTROL 


BACKUP FLIGHT CONTROL . 
ATMOSPHERIC REVITALIZATION 
(ARS, ARPCS, Airlock) 

LIFE SUPPORT 


ACTIVE THERMAL CONTROL & 
WATER SPRAY BOILER 


CREW PROVISIONS, ACCOMMODATIONS 
& EMERGENCY EGRESS 


CREW ESCAPE - 102 PRE-AAMOD ONLY 
TUNNEL ADAPTER 


.. 


*See TABLE 5.0 for EPD&C/INTERFACING SUBSYSTEM IDENTIFIERS 
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Table 5.0 - EPD&C/INTERFACING SUBSYSTEM IDENTIFIERS 


ELECTRICAL INTERFACE MECHANICAL SUBSYSTEMS 
05-6АА 01-5 Я Purge, Vent & Drain 
05-6AB 01-5 Yent Doors 

05-6B 02-1 Landinq Deceleration 
05-6ВА 02-1 Landing Gear Contro] 
05-688 02-1 Brake & Anti-Skid 
05-68C | 02-1 Nosewheel Steering 
05-6C 02-2 Docking Mechanism 
05-6D | 02-3 Separation 

05-60А 02-3 Carrier A/C Separation 


ACTUATION MECHANISMS SUBSYSTEMS 


05-6ЕА 02-4А Hatches 

05-6ЕВ 02-48 Payload Bay Door 

05-6ЕС 02-4С Rudder/Speedbrake, Воду Flap 

05-6ED 02-4 ET Umbilical Doors 

05-6ЕЕ | 02-4 ADP Deploy 4 Htr 

05-6ЕҒ ` і 02-4 Star Tracker Doors 

05-6EG - -—---- 02-4 —— Freon Radiator Deploy 

05-6ЕН 02-4 Rendezvous Radar 4 Comm. Antenna пері ду 

05-6Ғ 02-5 Payload Retention, Manipulator 
Positioning А 

05-66 02-6 Hydraulics 

05-61А 02-5 Remote Manipulator Arm 

05-618 02-5 Manipulator Deploy Control 

05-61С 02-5 Manipulator Latch Control 

05-610 02-5 : Manipulator Arm Shoulder Jettison & 
Retention Arm Jettison 

05-61Е | 02-5 DAC Camera-PL8 OPS 
PROPULSION SUBSYSTEMS 

05-69 03-1 Маїп Ргори151оп 

05-6КА 03-24 Reaction Control-Aft 

05-6КЕ 03-2Ғ Reaction Control -Fwd 

05-61, 03-3 Orbital Maneuvering 

05-6LA 03-3 OMS Auxiliary Kit 


POWER GENERATION SUBSYSTEMS 


05-6МА 04-ТА Electrical Power Generation - Fuel Cell 


05-6МВ 04-1 Electrical Power Generation - Суго 
05-6N 04-2 Auxiliary Power Unit * 
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Table 5.0 ~ (Cont'd.) 


ELECTRICAL INTERFACE AVIONICS SUBSYSTEMS 

05-60 . 05-1 Guidance, Navigation & Control 
Communications & Tracking: 

05-6РА | 05-2А . Audio 

05-6PB 05-2B | UHF 

05-6PC 05-2C TACAN 

05-6Р0 05-20 Altimeter 

05-6РЕ 7 05-2Е Microwave Scan Seam Landing (М5815) 

05-6PG 05-26 S-Band 

05-6PJ :05-24 Payload Interragator 

05-6РК 05-2K Closed Circuit ТУ (TY) 

05-6PH | Ground Command Interface Logic (GCIL) 

05-6PR 05-2R Ku-Band Согт. 8 Radar 

05-60 | 05-3 Displays & Controls 

05-68 05-4 Instrumentation 

05-65 05-5 Data Processing & Software 

05-6T 05-8 Backup Flight Control 

05-6 05-6 Electrical Power Distribution & Control 


ECLSS SUBSYSTEM . 
05-6U 06-1 . Atmospheric Revitalizatin - ARS, ARPCS 


05-6UA 06-1 Airlock Environmental Control 
05-6Y 06-2 Smoke Detection, Fire Suppression 
05-6МА 06-7 АВРС5 

05-6Ү8 06-2 i Galley 

05-6ҮС 06-2 Waste Management 

05-6YD 06-2 Water Management 

05-6W 06-3 | Active Thermal Control 

05-6Y 07-1 Crew Station 4 Equipment 

05-67 07-2 Сген Езсаре 
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4.1.4 (410) FUNCTION: Describe the function performed by the component. Also, 
enter the component designator(s) as identified on the design schematic. 


41,5 (Е4, С5, C6) QUANTITY: Enter the total number of items having identical part 
numbers performing the same function in the subsystem. The E4 field will 
reflect the total quantity in Arabic numerals. The C5 and C6 fields will 
reflect written quantities. 

4.1.6 (C7, C8) PART NUMBER: | 
a. C7) ROCKWELL PART NUMBER: Enter the appropriate Rockwell part number in 

accordance with the following ORM/SRM example, starting at the most 

left-hand-position - 

(1) Ү070-ХХХХХХ (Airborne, In-House) 

(2) MEXXX-XXXX (SCD) 

(3) MCXXX-XXXX (Procurement Spec) | | 

Note: Dash numbers to basic part numbers are required when the basic 

part number has dash numbers having differences in the failure mode and 

effects. 

(C8) SUPPLIER PART NUMBER Я SUPPLIER NAME: Enter supplier part number | 


and supplier name (abbreviate if required) when available for МЕ and MC 
part numbers. 


с 
се 


4.1.7 (011-14) REFERENCE DOCUMENTS: Enter the referenced schematic diagram first, 
followed by the related block diagrams, logic diagrams, etc. 


4.1.8 (C9, СТО) FMEA PREPARED BY: Enter the initials and last name of the 
Reliability Subsystem Analyst and Design Engineer who prepared the subsystem 
FMEA. 


төв- DATA SHEET NO. 2 


4.1.9 (DI, LYT, LYI) DATA IDENTIFIERS: Indicate appropriate action and specify the 
subsystem and component ID as described for Data Sheet Мо. 1: 


4.1.10 (LY3) FAILURE MODE SEQUENCE: Assign different sequence numbers (e.g., 
1, 2 - 5) for various failure modes of the specified component. 
Do not use leading zero's. | 
Example: (143) — 1, NOT (LY3) 0001. 


> > 
лас: AS 
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4.1.11 (C31, 9130, C32) FAILURE MODE: Enter first the basic failure mode 
(keyword) (C31), then any additional modifiers (4130) necessary to fully describe 
, the specific failure mode - the exact manner in which the item fails. Fallure 
mode keyword identifiers are listed below. Selection should include but not be 
limited to those listed. 


FAILURE MODE KEYWORD IDENTIFIERS 


++ жщ, 


“ STRUCTURAL FAILURE (RUPTURE) | " INADVERTENT OPERATION * PREMATURE OPERATION 


> PHYSICAL BINDING/JAMMING > INTERMITTENT OPERATION “ DELAYED OPERATION 

® FAILS TO REMAIN OPEN/CLOSED * ERRATIC OPERATION : * ERRONEOUS OUTPUT 

* FAILS MID-TRAVEL * ERRONEOUS INDICATION * LOSS OF OR PARTIAL OUTPUT 
ы FAILS TO OPEN/CLOSE * RESTRICTED FLOW 9 SHORTED ` 

> INTERNAL/EXTERNAL LEAKAGE * FAILS TO START/STOP * OPEN (ELECTRICAL) 

* FAILS OUT OF TOLERANCE * FAILS TO SWITCH > LEAKAGE (ELECTRICAL) 


Appendix B, paragraph 3.1.1, sub-paragraph 13, reflects the ground rule to be 
used for external leakage. For 0\-102 рге-АА mod only, those failure modes which 
result in а criticality classification of 1 and 2, ог 18 and 2R, and appear in 
the CIL (item 4.1.22) shall be classified further as structural or functional 
failures by circling "S" or "Є" іп the C32 field. The following guidelines apply: 
STRUCTURAL (S) - A failure mode involving structural failure of a pressure 
vessel, component housing, fluid lines, attach fittings, or load-carryiag 
members such as cranks or rods. 
FUNCTIONAL (F) - A failure mode, generally within a component, which negates 
the described component function. This type of failure would include 
binding, leakage, failure to open or close, or loss of output. The failure 
cause could be improper installation of parts or structural failure of power 
transmitting parts such as gear teeth, shafts or springs; however, in such 
instances the mode 1$ still classified as functional. Electrical and 
electronic component failures would normally fall іп this category. 
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4.1.12 0\-102 PRE-AA MOD ONLY: | 
(С62-66) APPLICABLE MISSIONS: Enter ап "Х" іп the block of the mission to 
which the FMEA applies. 


Horizontal Flight Test C62 
Vertical Flight Test C63 
Ferry Flight C64 
Operational Flights C65 

` Specific Orbital Mission 066. 


Note: “Operational Flights" and "Specific Orbital Mission” are not to be 
used for the duration of OV-101 and OV-102 flight test programs. 


OPERATIONAL VEHICLE(S): m 
(C83 - C86) VEHICLE EFFECTIYITY: Enter an "X" in the appropriate block(s) to 
which the FMEA appplies. 


Orbiter Yehicle 102 C83 
Orbiter Yehicle 099 C84 
Orbiter Yehicle 103 C85 


Orbiter Vehicle 104 4 SUBS (86 


4.1.13 (C33-37) MISSION PHASE(S): Enter an "X" in appropriate box(es) to indicate 
when the specifíed effects would be manifested. If the failure occurs at 
. discrete points in time within a given mission phase, and different effects 


may be observed, it may be necessary to define the subphase or event under 
"EFFECTS". 


4.1.14 (C38, C58) ABORT CRITICAL COMPONENTS: 
a. For those items whose criticality is increased to 1/1 during an abort 
resulting from unrelated failures, enter the word "Abort" (C38 - six 
spaces only), followed by the appropriate acronym(s); і.е., 


(C58) RTLS ~ Return to Landing Site  - . 
(C58) AOA - Abort Once Around 
(C58) АТО - Abort to Orbit : 


ь. For non-redundant modes where normal mission effect is criticality 3 but 
are hardware criticality 1 unique to intact abort, classify these modes 
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as hardware criticality 1 and functional criticality 1. Add іп 910 
(FUNCTION) the notation, "Unique to Intact Abort".  Add-appropriate 
intact abort notation іп a. above. 

Additional information must also be entered under J240, EFFECT(S) - see 

paragraph 4.1.16. NOTE: For SSME induced aborts, maximum two engine burn 

time is approximately twelve minutes. If "TIME TO. EFFECT" is equal to ог 


~ greater than twelve minutes, there 15 no change in criticality. 


4.1.15 (2380) CAUSE(S): Enter causes including but not limited to those listed 


below and amplify as necessary. See paragraph 4.4.2 for instructions on 
supplier furnished piece parts. 


CAUSES 
CONTAMINATION * TEMPERATURE (HIGH/LOW) ° INADVERTENT OPERATION/ACTIVATION 
MECHANICAL SHOCK * THERMAL SHOCK * VIBRATION 
VACUUM * PRESSURE (HIGH/LOM) * PROCEDURAL ERROR 
ACOUSTICS * IONIZING RADIATION * CHEMICAL REACTION 
OVERLOAD * ACCELERATION 7 LOSS OF /IMPROPER INPUT 


MISHANDLING OR ABUSE ° ELECTROMAGNETIC FIELDS ° PIECE-PART STRUCTURAL FAILURE : 


4.1.16 (J240) EFFECT(S): Enter the letters (A), (B), (C) or (D) as defined in the 


headings of Appendix A, together with the words under each heading describing 
the effects on the subsystem, interfaces, mission, and crew/vehicle, 
respectively, and explain. If the identified effect is not listed, describe 
briefly. Where the effect is the same for two or more of the above, 
consolidate entries. Specify if there is no effect on a specific category or 
categories and provide a brief explanation. In those instances when time to 
abort requires automatic operation or immediate dependence on a parallel 
subsystem and such 15 provided, the effect on mission is "None" with 
explanation for each mission phase as appropriate. See section 4.1.214. for 
screening of functional criticality 3 failure modes. For those items 
identified as abort critical [see paragraph 4.1.14) enter, subsequent to the 
(А), (В), (С) and (р) entries, the criticality and effects per the following 
example: | 
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"Crit Т for RTLS - Loss of additional engine-vehicle loss" 

| ог i . 
"Crit 1 for RTLS - Incomplete propellant dump, stability problem, 
probable vehicle 1055." 
Where functional criticality 15 18 ог 28 per paragraph 4.3.2 and 
hardware criticality is 3, the appropriate entry for "FUNCTIONAL" 


" effects should be included. The "FUNCTONAL" effects entry relative to 
the loss of all functional redundancy will be entered per the following 
example: | 


(Е) FUNCTIONAL CRITICALITY EFFECT: 
Possible loss of crew/vehicle (specify) or probable loss of crew/ 
vehicle (describe) or loss of crew/vehicle. 


4.1.17 (C39) TIME TO EFFECT: 
Immediate - less than 1 second 
Seconds - 1 to 50 seconds 
Minutes - 50 seconds to 50 minutes 
Hours - 50 minutes to 20 hours 
Days - 20 hours to mission completion E 
Enter the descriptor which indicates shortest credible time or time range 
available to correct the situation before the effect is manifested. 

4.1.18 (C40-45) FAILURE DETECTABLE: Enter "YES" or "NO" in the block following "IN 
FLIGHT" and "GROUND TURNAROUND". If either answer is "YES", indicate how it 
can be detectable -- symptoms, instrumentation, etc. Include measurement 
number from MML (Master Measurements List) where applicable and available. 
(See section 4.3.5, Instrumentation FMEA's.) Development flight instrumen- 
tation (ОРІ) measurements will not be used as a means of detectability. 


4.1.19 (2490) CORRECTING ACTION: Describe any action, automatic or manual, which 
may be taken to circumvent the specified failure. Also identify any 
alternate means (utilizing "unlike" hardware) of accomplishing the function 
performed by the item or its assembly. If none, so indicate: For 
instruments (sensors, transducers, etc.) that provide measurements assessed 
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as critical to vehicle/crew safety or mission continuation, the FMEA shall 
identify the redundant or alternate measurements by Measurement List 
identification number. 


4.1.20 (C77) NUMBER OF SUCCESS PATHS REMAINING AFTER FIRST FAILURE: With respect 
to the item being evaluated, indicate the number of ways remaining to perform 
the function after the first failure. You may leave the block blank for 

“non-critical functions. | 


4.1.21 (C53, С55-57) REDUNDANCY SCREEN: For all criticality IR, 2 апа 2К failure 
modes (see FIGURE 8 and paragraphs 4.3.1 and 4.3.2) cirele "Р" (PASS), "Р" 
(FAIL), or “НА” (NOT APPLICABLE) for each of the following tests: 


a. 
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Redundant elements are capable of checkout during normal ground 

turnaround with no vehicle design modification. Where a subsystem is 

characterized by redundant strings and the status of each string can be 

verified during ground turnaround, no individual component(s) in any one 

string should be shown as failing this screen. 

NOTE: This screen is not applicable under the following conditions: 

(1) Pyrotechnic devices, excluding electrica] control circuitry. 

(2) Non-redundant item. 

Loss of a redundant element is readily detectable during flight. Where 

a subsystem is characterized by redundant strings and the status of each 

string can be verified in flight, no individua] component(s) in any one 

string should be shown as failing this screen. 

NOTE: This screen is not applicable under the following conditions: 

(1) Standby redundancy (redundant paths were only one path is 
operational at any given time). 

(2) А11 functional paths of any subsystem which is inoperative (during 
such inoperative periods). This groundrule does not apply if the 

^-redundant elements are operative during any normal mission phase; 

1.е., the screen is considered applicable if the element is 
operative during any normal mission phase. 

(3) Pyrotechnic devices. : 

(4) Mechanical linkage. ° 

(5) Non-redundant item. | 

(6) Subtier level redundant functional path(s) (power/control circuits, 
etc., failures where the primary functional path (LRU, etc.) 15 


2? 
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Criticality 183 ог 283 and the primary redundancy would not ђе 
degraded (1.е., 1055 of two of the subtier functional paths would 
not result in an abort decision). 
Failure of an element to pass this screen should be in dírect relation 
to the noted failure mode under normally expected environmental 
conditions. Consideration of environmental extremes as caused which 
could induce "multiple order failure" is limited to abnormal conditions 
generally resulting from some other failure. Where multiple failures 
must first occur to result ín environmenta] extremes, such events may be 
considered non-credible. Аз a ground rule, it may be assumed that 
hardware items will be qualified and properly installed to withstand the 
"design-to" environmental envelope. The following are typical questions 
to be answered іп this phase of the analysis: 
(1) Contamination: 2 
(а) Are the items being evaluated susceptible to contamination? 
(b) Is contamination a credible event or does the design 
(including filters) result in this failure mode being 
categorized as non-credible? 
(2) Explosion: i 
(a) Is there a credible source? 
(b) Must other multiple failures occur first to result in the 
explosion? | 
(с) Is the explosion catastrophic to crew or vehicle? 
(4) Is the container frangible? 
(е) Аге the items being considered susceptible to this type of 
damage in view of their physical characteristics and location; 
1.е., shielding? 
3. Temperature: 
(а) Are components susceptible to damage or failure from high 
ке temperature? 

(b) Other than as a result of multiple failures, is such exposure 
credible? This implies temperature peaks or sustained levels 
sufficient to cause catastrophic effects on the component in a 
short time. For example, temperature increases to certain 
levels merely increase electronic parts failure rates - the 
actua] failure and time of occurrence are 51111 
probabilistic. 
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(4) Vibration, Shock, Acceleration, Acoustics, etc.: 

(a) Assuming that components are qualifíed and properly installed 
to withstand design environments, can a credible cause be 
identified which would cause these levels to be exceeded? 

(b) Are vibration/shock/acceleration-sensitive redundant units 
physically oriented or separated to reduce the chance of 
multiple failure from the same cause(s] and 15 there 
sufficient analysis and test data to verify the failure as 
non-credible? 

(5) Fire: 

Do not consider fire as one of the single events or causes in 

failing screen "C". NASA has edicted that fire not be considered 

one of the events (NB/83-L 216). 

If none of the redundancy screens are applicable, enter "NA" in the C53 
field and briefly explain reason for REMARKS /HAZARDS. 


Screening of Functional Criticality 3 Failure Modes 
(1) Where the failure modes have been identified as non-critical for 
_ loss of all redundancy (Criticality 3), enter "NA" іп the C53 

field. Enter under "REMARKS" the notation, "Criticality 3 failure 
mode - loss of all redundancy would have no effect on the míssion 
or crew/vehicle safety". In such cases, minimum entries on Data 
Sheet Но. 2 consist of DI, LYI, LY2, ҮЗ, СЗТ, C53 and J240. For 
functional Criticality 3 items, J240 must contain a brief 
explanation regarding the assigned criticality. 


(2) Where a component has an identified failure mode in the Criticality 
1 of 2 category, and additional functional Criticality 3 failure 
modes are identified, these Criticality 3 modes will be treated as 

— described іп para. (1) above. 


4.1.22 CRITICALITY: 


b. 
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(C54 - HARDWARE) - Enter 1, 2 ог 3 based on the definitjons in section 


2.0 and the ground rules contained in section 4.3.1 and Appendix 8, 
paragraph 3.1.1, sub-paragraph 1. 


(C57 - FUNCTIONAL) - Enter 1, 2, 18, 28 or 3 based on the definitions in 


section 2.0 and the ground rules contained in section 4.3.2 and Appendix 
B, paragraph 3.1.1, sub-paragraph 1. і 
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4.1.23 (J500) REMARKS/HAZARDS: Identify potential hazards resulting from the 
specified failure. Enter the words "Hazard Potential" followed by 
appropriate explanation and any other comments or recommendations that might 
prove useful in evaluating the system. Indicate requirements for additional 
instrumentation, and any other special consideration. 


4.1.24 (4600) DISPOSITION AND RATIONALE: For criticality 1 and 2 items, and/or 18, 
2R items that fail a redundancy screen and/or hardware criticality 2 items 
where the screen is NA, in all of the following categories to describe the 
retention criteria. Each category must reflect a description of rationale 
for retention of the item: 

a. Design - Identification of design features which minimize the occurrence 
of the failure mode апа causes. 

b. Test - identification of specific tests accomplished to detect failure 
mode and causes during acceptance tests, certification tests, and 
checkout tests. 

с. Inspection - Statement that specific inspection points are included to 
determine that specific failure mode causes are not inadvertently 
manufactured into the hardware. 

d. Failure History - Provide an indication that the hardware or similar 
hardware has been used successfully and that a history of generic 


failures does not exist. If the hardware is new to this program, so 
state. 


4.1.25 (C9, СТО) APPROVAL: Responsible Reliability and Design approval signatures 
as follows: 


a. Subsystem FMEA package: Design/Reliability Manager 
b. Figure 2 (FMEA) - PREPARED BY: Design Responsible 
-— Reliability Analyst's Name 
APPROVED BY: Design ‚ Signature 
Reliability (Analyst) Signature 
c. Figure 3 (CIL) - APPROVED BY: Design (Supervisor) _: Signature 
Reliability (Supervisor) Signature 


NOTE: The initial issue of а CIL sheet will be signed by the Reliability 
Supervisor. Signatures will not be required on subsequent issues 


unless the CIL sheet is revised. | 
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4.2 REVISIONS 4 SUBMITTALS 
Revisions to the FMEA will be made as follows: 


1. 
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а.. 


с. 
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New Data: Т 

(1) To identify new components or failure modes, use the data 
entry sheets and follow the instruction given in section 4.1. 

(2) To add information to a component or failure mode record, 
either a blank data sheet or the appropriate page of the data 
printout working copy may be used. 

(a) Data Entry Sheets - Using a blank data sheet, circle "R" 
(Revise) on the "Data Identifier" line (DI, FIGURE 4 or 
5) and enter the correct subsystem/component/(failure 
mode) ID number to identify the record to which the 
information is to be added. Fill in complete blocks of 
information to be added (e.g., Disposition block), and 
Submit for keypunching. 

(b) Data Printout - Circle "А" (Revise) on the "Data 
Identifier" line (DI, FIGURES 6 and 7) of the record to 
which new information 15 to be added. Using a colored 
pen or pencíl, enter the information in the appropriate 
blocks and submit for keypunch. 

Data Entry Change: 

Circle the "R" (Revise) on the "Data Idenifier" line (DI, FIGURE 4 

or 5) and either "red-line" the appropriate sheet of the data 

' printout or re-enter the data as it should appear, using the 

appropriate data entry sheet as described in section 4.2, paragraph 

(a) Data Entry Sheets. To clear the "J" field of any remaining 
unwanted information, asterisk (*) the blank Tines within the 
block on the master record and supporting record work sheets. 

Data Deletion: 


(1) To delete data, circle the "В" on the "Data Identifier” line 
(DI, FIGURE 6 or 7) of the appropriate data printout sheet, 
cross out the entry to be deleted with a colored pen or pencil 


2. 
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and submit for keypunching. If a blank data sheet is used, 
enter an asterisk (5) in the block which corresponds to the 
entry to be deleted. 


(2) To delete the entire record (1.е., al] data pertaining to а 
particular failure mode or component) and all related entries, 
circle the "0" (Delete) on the appropriate sheets of the data 
printout. Again, filling out the data identifier line of a 
blank data sheet will accomplish the same purpose. A11 
information pertaining to a particular component or failure 
mode will be deleted. | 


Data Identifier Change: 
To change а data identifier (1.11, 2 or 3), it is necessary to 


delete the entire record under the old number and re-entrer (add) 
under а new number. The B999/revision data on computer reports is 
automated and prints the date of the latest update or revision. 


Identification of Revisions/Changes: | 
Identify each line changed with a vertical biack баг on the left- 


hand margin of the page. 


FMEA/CIL Submittal 


Critical Items List (CIL) 

Updates will include the following: 

(1) Any new CIL items | 

(2) Updates to existing items having technical changes affecting 
the following sections: 


"ee (a) function 


(b) failure mode . 
(с) failure effects 

(4) criticality 

(e) abort critical components 
(f) failure detectability (redundancy screen) 

Other changes will be incorporated when pages are submitted 
for the above reasons. 
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b.  FMEA's 
Updates of the FMEA's will be at six month intervals linked to 
nearest scheduled CIL FRR publication. Only those changes related 
to the CIL submittals (a above) and other technical changes will be 
submitted. 


4.3 IMPLEMENTATION GROUND RULES (See also Appendix B - Ground Rules and Criteria) 
4.3.1 HARDWARE CRITICALITY DETERMINATION 


Hardware criticality will be determined by the categorization of the singular 
effect of the identified failure mode on the subsystem/vehicle (See FIGURE 
10). FIGURE 8 illustrates the analytical logic for criticality determination 
of ali functional hardware. 


1. Reliability Engineering identifies hardware where if redundancy fails 
the effect would be critical. fap аз 226 22, 522.26 
г. Reliability and Design Engineering jointly identify those equipments 
with (single point) criticality 1 or 2 failure modes. Those equipments 
that are not criticality 1 because they incorporate redundancy are then 
screened further, as described in paragraph 4.1.21, and appropriate 
entries made in the FMEA data sheet. 


NOTE: The criticality of instrumentation and test ports will be 
assessed according to their function. Test ports, when capped, shall be 
treated as a structural part of the component and not be considered 
further. Where instrumentation (e,g., pressure transducer) penetrates 
the wall of a component or line and structural failure of the joint 
would result in gross leakage, the failure mode shall be considered as a 
failure of the component or line. The criticality of the instrument- 
ation, therefore, would not be affected in such instances. 


23. The criticality of those systems which are to be used only in the event 
of an emergency shall be established strictly on the basis of direct 
failure effect on crew, vehicle, or mission, regardless of the number of 
prior failures which must occur before the use of the system is required. 
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All other backup or standby equipment (e.g., relief valves, cross-feed 
valves, etc.) shall be assigned criticality in the normal manner. 


4.3.2 FUNCTIONAL CRITICALITY DETERMINATION 
Functional criticality will be determined by the categorization of the effect 
on the subsystem/vehicle of loss of all redundancy (like or unlike) for the 
identified failure mode (See FIGURE 10). FIGURE 8 illustrates the analytical 
logic for criticality determination of a11 functional hardware. 


l. 


2. 


Reliability Engineering identifies hardware if all like or unlike 
redundancy fails the effect would be critical. 


Reliability and Design Engineering jointly identify those equipments 
with criticality 1R or 2R failure modes. 


4.3.3 CIL CONTENT CRITERIA 


1. 


2. 
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The following classification of failure modes will be entered in the CIL: 
а. АТ! functional /nardware criticality category 1Л'$, 2/2'5, and 
1825. 9 
b. All criticality category 1R3's and 28375 that fail one or more 
redundancy screens. 
C. All failure modes that become criticality category 1/1 during 
{ntact abort. 


CIL Section 12.0 - Critical Items List orbiter modifications to support 
special missions: 


This section of the Critical Items List contains those critical items 
associated with Orbiter subsystems that have been added to or modified 
by Orbiter Mission Kits to support special missions. These CIL items 
will only apply to specific vehicle missions as noted ій this specific 
CIL subsection. . 

This CIL section contains the single failure points and criticality 18 
and 2R CIL items identified by the Failure Mode Effects Analysis (FMEA) 
conducted on the Orbiter subsystems that have been added to or modified 
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to support special mission application. These vehicle changes are 
identified by individual Mission Kits which are installed specifically 
for these special missions and would be removed when thé mission 
objectives have been achieved. Each vehicle change is identified by a 
Master Change Record (МСА) and 15 referenced in the applicable FMEA. 


Each critical failure mode identified іп the vehicle modification 
E" section is categorized on à separate Critical Items List form which 
і includes the failure causes, effects, and rationale for retention. СП. 
dispositions and rationale are contained on individual CIL sheets and 
those that are generally applicable to all components are contained in 
Section 3.0. 


A critical items list summary із included for each major vehicle 
modification. Additions will be made to this CIL section to maintain 
this document current with the vehicle flight configuration. CIL page 
revisions are indicated by revision date. 


NOTE: Prior to each CIL submittal, notify the CIL coordinator of any input to 
CIL Section 12.0. ў 


4.3.4 MECHANICAL/ELECTRICAL INTERFACE 

For mechanical components having an electrical interface, the mechanical FMEA 
will consider only the effects of “black box” functional failure (e.g., loss 
of output, premature signal, etc.). Where it becomes necessary to conduct an 
FMEA within the "black box” because of the assigned criticality (1 or 2), the 
FMEA will be conducted by Avionics Reliability who will be provided with the 
following information іп the mechanical FMEA regarding the failure effects on 
the mechanical system: 


a. Enter under "CAUSE" (0380), each applicable failure mode of the electro- 
mechanical device reflecting the avionics malfunction causing the 
failure mode; i.e., 1055 of electrical power, premature.electrical 
signal, etc. | 

L] 

b. Identify under "REFERENCE DOCUMENTS" (С11-14), the specific mechanical/ 

avionics interface. 
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The electrical interface FMEA will be included іп the appropriate section of 
the avionics FMEA. For criticality 1, 1R, 2 or 28 failure modes, the 
mechanical FMEA, which considers the effect of “black box" loss of function, 
will indicate in the "REMARKS" section the avioiics FMEA number of the "black 
box". The avionics FMEA of the "black box" will contain a similar reference 
to the appropriate mechanical FMEA. At the earliest point in time when the 
mechanical analyst can ascertain that the “black box” is criticality 1, 18, 2 


“ог 28, it shall be his responsibility to convey to the Avionics Reliability 


4.3.5 


4.4 


4.4.1 


group copies of his worksheets to facilitate initiation of detailed avionics 
analysis effort. 


INSTRUMENTATION FMEA'S 

Instrumentation (e.g., sensors, signal conditioners, etc.) may be provided by 
either Avionics Instrumentation or by a specific Design group. Іп either 
case, instrumentation FMEA's will be included in the FMEA for the using 
subsystem. Criticality 3 instrumentation may be listed on one FMEA form by 
family or type. FMEA's for criticality 1 or 2 and criticality 18 and 28 
instrumentation that fail a redundancy screen ог the screen is "NA", will be 
completed in their entirety and included in the using subsystem CIL. ` 
Avionics Reliability will provide support as required to identify failure 
modes, retention rationale, etc. 


A copy of each instrumentation FMEA completed by a Mechanical Reliability 
group will be provided to Avionics Reliability. 


SUPPLIER FMEA UTILIZATION 


GENERAL 

In many instances, depending on the cost, complexity, and state of 
development of the design, suppliers will be required to develop and submit 
FMEA's reflecting their area of design responsibility. The submissions will 
precede the joint supplier/Rockwell РОК or CDR. (See the applicable PORD for 
content requiremennts and submittal schedules.) FIGURE 9 shows the overall 
supplier FMEA flow as related to the in-house effort. 
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4.4.2 FMEA UTILIZATION s 
Upon receipt of a supplier FMEA, the responsible RSA will compare the 
identified failure modes with those called out on his corresponding. subsystem 
FMEA and update his FMEA as required (see section 4.2) to include any failure 
modes not already identified relating to subsystem effect. Supplier FMEA's 
will be reviewed for single failure points below the black box level by 

"Rockwell and analyzed for corrective action directly with the supplier as 

part of their design review. Where Rockwell does not concur with portions of 
the supplier analysis, telephone contact with the supplier Reliability 
Engineer normally should suffice to resolve any differences. If not, the 
matter shall be resolved through normal Rockwell data handling procedures. 
Supplier black boxes will be identified in the subsystem FMEA based on the 
supplier schematic or drawing part identification number. For criticality 1 
or 2 and 1R or 2R (CIL only) electronic black boxes, the piece parts (or if 
all or many circuits, so state) identified by the supplier FMEA which are 
single point failures that have a direct critical effect on the vehicle will 
be described with reference to the supplier FMEA in the "CAUSE" section of 
the applicable failure mode identified at the subsystem level. Parts will be 
listed only in those cases where less than five parts are involved. 


4.5 ELEMENT CONTRACTOR FMEA CORRELATION 


Requirements and procedures for conducting interfacing analyses and for 
element integration tasks are contained in Reliability Desk Instruction 100-12 
(Shuttle Element Interface). 


4.6 Gt 


For ítems identified аз GFE hardware, NASA will identify those which require 
FMEA's and will perform FMEA's on the hardware identified to the level defined by 
their ground rules. Upon completion of the FMEA, NASA will provide Rockwell with a 
copy. In addition to the completed copy, a preliminary copy may be transmitted. 
Upon receipt of the GFE FMEA, Rockwell will evaluate the interface effects on the 
Orbiter defined by the GFE FMEA. 
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Appropriate comments shall be included to insure that this area is correct 
and complete. Rockwell will conduct РМЕА’$ for а11 interfaces between CFE and 
GFE. The Rockwell FMEA will consider all failure modes consistent with this desk 
instruction. The analysis is to consider as a "CAUSE" any failure mode identified 
by the GFE FMEA which could produce a failure in the CFE interface. Where GFE 
failures are identified as a "CAUSE", the appropriate GFE FMEA and document number 
shall be identified as a part of the "CAUSE" section. In addition, those vehicle 
failures which could cause FMEA failure modes will be identified to NASA in the 
comments to the GFE FMEA. Where structural failures are identified, appropriate 
hazards analyses shall be included in available. 


The accountability of CIL items for GFE will be NASA. Those CIL items 
resulting from interface failure modes will be a part of the Rockwell CIL. 


Exceptions to this instruction will be identified and concurred in jointly by 
Rockwell] and NASA and documented as a part of letters of agreement. 
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CROSS REFERENCE TABLE 


CRITICALITY 
` CATEGORY 


E зангыг BLOCK | — || | 
LEVEL OF DIAGRAM FUNCTIONAL HARDWARE 
FUNCTION И REDUNDANCY DEFINITIONS DEFINITIONS 


LIFE OR 
VEHICLE NO ў 
ESSENTIAL REDUNDANCY 


ye 


| 1 1 
(CIL) | (CIL) 


üb 


MISSION NO | | 2 2 
ESSENTIAL REDUNDANCY (o (CIL) (CIL) 


LIFE OR ; 
VEHICLE - DUAL 18 2 
ESSENTIAL / REDUNDANCY (CIL) (CIL) 
| “| -PASSED | FAILED 
| SCREEN | SCREEN 
MISSION DUAL ‚2А 28 
ESSENTIAL/ RED | ПУ (CIL) 


LIFE OR | EI 18 
VEHICLE / “TRIPLE (CIL) 
ESSENTIAL/ REDUNDANCY 

MISSION TRIPLE 28 28 
ESSENTIAL / REDUNDANCY (C1L) 


3 
ALL 
ALL NON- LEVELS OF 3 
ESSENTIAL REDUNDANCY 
| 


FIGURE 10 
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"FAILURE EFFECTS 


(А) ON FUNCTION OR SUBSYSTEM: 
- No Effect 
е Loss of Redundancy 
* Functional Degradation 
* Subsystem Degradation 
Loss of Function 
* Loss of Subsystem 


(B) ОМ INTERFACE FUNCTIONS OR SUBSYSTEMS: 

Q ect 

Loss of Interface Redundancy 
Degradation of Interface Function 
Degradation of Interface Subsystem 
Loss of Interface Function 

Loss of Subsystem 


(C) ON MISSION: 
777 T6 Effect 
* See Note Below for Criticality 2 Modes 
* Mission Modification 
° Loss of Entry Capability - Rescue 


(D) ON CREW/VEHICLE: 
о ect 


9 Possible Loss of Crew/Vehicle (Specify) 
„ Probable Loss of Crew/Vehicle (Conditions) 

Loss of Crew/Yehicle · 
NOTE: The following instruction is intended to clarify what should be entered in 
the FMEA/CIL under “EFFECTS ON MISSION” (item C under entry J240) for identified 
criticality 2 failure modes. і 


Criticality 2 failure (modes) are defined as: (1) single failures which would 
cause "loss of mission", and (2) failures wherein the next associated failure would 
cause loss of crew/vehicle (Appendix B, Section 3.1.1, Ground Rules, subparagraph 
1). 


The following chart (Mission Effects - Criticality 2 Failure Modes) is included as 
a guideline for entries under "EFFECTS ON MISSION". The term "abort decision" 


should only be used where there really is a decision. : 
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3.0 GROUND RULES AND CRITERIA ... . 


Тһе following ground rules and criteria are of a general category for 
guidance, as applicable, іп conducting and interpreting an FMEA. The applicable 
ground rules and criteria will be a part of the information which prefaces each 
FMEA. (See section 3.2, FMEA Content.) 


охь 


3.1 GENERAL GROUND RULES AND CRITERIA 


3.1.1 GROUND RULES 


1. 


2. 


3. 


4. 


5. 


0246} /30 


Criticality definitions are those delineated іп NHB 5300.4 (10-1), as 
illustrated in FIGURE 10 (Criticality Category Cross Reference Table). 
For the purpose of this analysis, hardware criticality 2 is further 
defined; i.e., dual redundancy where: 

a. The first failure would result in loss of mission. 

b. The next related failure would result in loss of life/vehicle. 


Criticality IR and 28 assumes failure of all like and unlike redundancy: 
А backup item, if when it is called upon to work, performs a function 
different from the item it is backing up, it should be classified based 
upon the effect if it.does not work when operated. If the backup item 
performs the same function as the item it 15 backing up, the backup 
should be classified as an unlike redundant item. 


Loss of mission is defined as follows: 
а. Operation payload interface hardware failure as it would result in 
loss of payload primary performance. 
b. ` Orbiter subsystem failure as it would result іп unplanned mission 
` termination for non-safety of flight reasons. . 


Categorization of a hardware item by the worst case potential effect of 
failure of that item will define criticality. 


Failure modes that could propagate to interfacing subsystems or 


experiments will be identified. 


6. 


8. 


9. 


11. 
12. 


13. 
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When defining FMEA's/CIL for а particular subsystem, interfacing 
subsystems will be considered to be operating within their specified 
tolerances. 


GFE FMEA data will be utilized in evaluating the GFE/Rockwell 
International interfaces for the vehicle FMEA and CIL. 


Failure detectability assumes the availablity of telemetry ог a crewman 
responding to monitored displays. Failure detectability also assumes 
other means of failure detection, where feasible, such as a crew 
response to physical stimuli; Т.е., smell, sound, etc. 


Specific FMEA criteria and assumptions will be defined for each 
subsystem. 


10. Identical components used for dífferent functions will be treated 


separately in the FMEA. 


Simultaneous failure of redundant components is identified where the 
failure cause encompasses both components. 


Subsystem analysis will include an evaluation of the effects of 
instrumentation failure upon/within the subsystem. 


External Leakage: 

а. The external leakage mode of functional hardware items from алу 
source (except mating of two surfaces by welding, brazing, or 
permaswage) will be considered. If this mode raises the 

~~ criticality of the items ín question, it will be documented and the 
potential leak source identified under "CAUSE(S)".' Otherwise, the 
external leakage will be treated generically by media. However, in 
those instances where external leakage results іп à hardware 
criticality 1 effect, the failure mode will be documented 
regardless of the basic criticality of the item being considered. 
Where applicable, seal failure should be listed as a cause and 
worst case (complete seal failure) shall be assumed, considering 


14. 


15. 
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b. 


с. 


4. 
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also any restrictive protection provided by barrfer design, where 
such data are available from Desiqn. Hazards associated with the 
loss of fluid in excess of requirements will be documented and 
covered by Hazard Analysis, but will not affect criticality (see 
section 3.3, paragraph 4.) 


The internal leak mode of functional hardware items will be 
considered. In those instances where internal leakage could result 
in a hardware criticality 1 or 2 failure mode effect (fail open or 
fail closed due to pressure lockup), "internal leakage" shall be 
entered in the "CAUSE" section of the most appropriate identified 
failure mode entry in lieu of "cause" 15 acceptable. | 


Where external or internal leak paths are protected by static or 
dynamic redundant (verifiable) seals, the leak path effect will be 
reduced by one criticality level. 


Pressure carriers (lines, pressure vessels) will be classified by 
worst case mode including external leakage. Lines will be entered 
generically for each independent media. Special lines (i.e., 
mechanical bellows, flex lines, etc.) will be entered 
individually. Tanks will be entered individually. 


The failure of any tank containing fluid media which, due to 115 
location in an enclosed vehicle compartment, could cause compartment 
overpressurization leading to structural failure (vehicle loss) will be 
classified hardware criticality 1 for tank rupture mode. 


АП lines will be designated the criticality applicable to the 
functional loss effect resulting from loss of medium with notation in 
the “REMARKS“ section of the FMEA as to the potential hazard due to 
compartment overpressurization resulting from line rupture. The main 
engine cryogenic feedlines will be treated as fluid tanks. 


3.1.2 CRITERIA 
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1. The FMEA and CIL will consider failures beginning with preflight/pre- . 
launch operations through post landing safings at Edwards Air Force 
Base/Kennedy Space Center (EAFB/KSC). 

a.  Prelaunch operations at KSC/VAFB are defined as beginning with 
propellant loading for each specific propulsion subsystem. Рог all 
other subsystems, prelaunch operations commence with start of main 
engine conditioning. 


b. Post landing safing operations include those activities performed 
after landing to prepare the orbiter for hangar operations and are 
defined as follows: 


(1) 
(2) 
(3) 
(4) 
(5) 
(6) 
(7) 


Deservice and draining of hazardous fluids. 
Safing of unused ordnance. 

Application of ground power and cooling. 
Removal of potentially hazardous components. 
Removal of pods and payloads. 

Purging and venting of gases. 

Installation of protective covers. 


2. Redundancy is defined as the use of more than one means of accomplishing 
a given task or function where all must fail before there 15 an overall 
failure of the function. ; 

а. Operational Redundancy - redundant elements, all of which are fully 
energized during the subsystem operating cycle. Operational 
redundancy includes load sharing redundancy wherein redundant 
elements are connected in such a manner that, upon failure of one 

з-1016, the remaining redundant elements will continue to perform the 
subsystem function. It is not necessary to switch'out the failed 
element nor to switch in the redundant element. 


b. Standby Redundancy - redundant elements that are non-operative 
(i.e., have no power applied) until they are switched into the 
subsystem upon failuare of the primary element. In these cases, as 
well as pyrotechnic devices, mechanical linkage and inoperative 
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functional paths of any subsystem, redundancy screen B is 
considered not applicable and so marked. This approach is based on 
the fact that these areas are subject to ground checkout; they are 
redundant and therefore provide a degree of protection in flight; 
it is confirmed that when called upon to operate, the inability to 
operate would be detected in flight for appropriate corrective 
action. | 


3. Where redundancy exists in the subsystem, the redundancy is considered 
during the analysis of a failure of the component. 


4. "Alternate means of operation” refers to accomplishment of a function 
and not necessarily to redundancy or restoration of a failed function. 


5. When fire hazards resulting from short circuits or other hardware 
failure modes are identified, consideration will be given to the effect 
of fire propagation to adjacent redundant equipment as a potential loss 
of the function. - 


Potential safety concerns created by component failure modes will ђе 
identified and handled through Hazards Analyses as required by ЕОМ 70 
1-4.2.5 and by NHB 5300.4 (10-1). 


6. Reference documents in the FMEA include released and controlled 
engineering drawings or specifications, when available. 


7. The following are used as aids in determining the failure modes and 
causes of subsystem hardware failures: 


2 — 


а. Generic failure тоде5 and causes. 2 

b. Released and controlled component, assembly, and detail engineering 
drawings and specifications. 5 

с. Training aids, as available; e.g., cross section drawings, 
photographs, exploded drawings (not referenced in FMEA). 

d. Actual hardware, if available. 

e. Use experience, including failure history and similar components. 
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8. 


9. 


10. 
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f. Controlled and released operational procedures. 
9. Component FMEA's prepared by component suppliers. 


Failure of structural items (primary and secondary) will not 5e 
considered as a part of this ananysis. (Structural items are assumed to 
be designed to preclude failure by use of adequate design safety 
factors.) | 


ЕМЕА' 5 of criticality 1 or 2 "black boxes" providing electrical signal 
intarface to mechanical components are included in the applicable 
avionics FMEA package with appropriate cross-referencing in the 
"REFERENCE DOCUMENTS" section of both the appropriate avionics and 
mechanical FMEA report, where available. 


The failure mode “Fails to Operate” will not be addressed for fuses. 
Use of a fuse with a higher current capacity then specified (wrong size 
installed or rating misidentified) is not considered a fuse failure 
mode. 
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Standard Test Methods for 


RUBBER PROPERTY —COMPRESSION SET" 


This standard is issued under the fixed designation D 395; the number immediately following the designation indicates the year of 
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. 
A superscript epsilon (е) indicates an editorial change since the last revision or reapproval. 


These methods have been approved for use by agencies of the Department of Defense and for listing in the DoD Index of Specifications 


and Standards. 


1. Scope 


1.1 These test methods cover the testing of 
rubber intended for use in applications in which 
the rubber will be subjected to compressive 
stresses in air or liquid media. They are applica- 
ble particularly to the rubber used in machinery 
mountings, vibration dampers, and seals. Two 
methods are covered as follows: 


Sec- 
Method tion 
A—Compression Set Under Constant Force 7-10 


in Air 
B—Compression Set Under Constant Deflec- 
tion in Air 


11-14 


1.2 The choice of method is optional, but 
consideration should be given to the nature of 
the service for which correlation of test results 
may be sought. Unless otherwise stated in a 
detailed specification, Method B shall be used. 

1.3 Method B is not suitable for vulcanizates 
harder than 90 IRHD. 

1.4 The values stated in SI units are to be 
regarded as the standard. 

1.5 This standard may involve hazardous ma- 
terials, operations, and equipment. This standard 
does not purport to address all of the safety prob- 
lems associated with its use. It is the responsibil- 
ity of whoever uses this standard to consult and 
establish appropriate safety and health practices 
and determine the applicability of regulatory limi- 
tations prior to use. 


2. Applicable Documents 

2.1 ASTM Standards: 

D 1349 Practice for Rubber—Standard Tem- 
peratures and Atmospheres for Testing and 
Conditioning? 

D 3040 Practice for Preparing Precision State- 


ments for Standards Related to Rubber and 
Rubber Testing? 

D 3182 Practice for Rubber— Materials, 
Equipment, and Procedures for Mixing 
Standard Compounds and Preparing Stand- 
ard Vulcanized Sheets? 

D 3183 Practice for Rubber—Preparation of 
Pieces for Test Purposes from Products? 

D 3767 Practice for Rubber—Measurement of 
Dimensions? 

E 145 Specification for Gravity-Convection 
and Forced-Ventilation Ovens* 

Note 1--Тһе specific dated edition of Practice 


D 3040 that prevails in this document is referenced in 
the Precision section. 


3. Summary of Methods 


3.1 A test specimen is compressed to either a 
deflection or by a specified force and maintained 
under this condition for a specified time and at 
a specified temperature. 

3.2 The residual deformation of a test speci- 
men is measured 30 min after removal from a 
suitable compression device in which the speci- 
men had been subjected for a definite time to 
compressive deformation under specified condi- 
(1005. 

3.3 After the measurement of the residual de- 
formation, the compression set as specified in the 


' These test methods are under the jurisdiction of ASTM 
Committee D-11 on Rubber and are the direct responsibility of 
Subcommittee 011.10 on Physical Testing. 

Current edition approved Sept. 27, 1985. Published Novem- 
Бег 1985. Originally published as D 395 - 34. Last previous 
edition D 395 - 84. 

! Annual Book of ASTM Standards, Vols 09.01 and 09.02. 

3 annual Book of ASTM Standards, Vol 09.01. 

* 4nnual Book of ASTM Standards, Vol 14.02. 
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appropriate method, is calculated according to 
Eqs (1) and (2). 


4. Significance and Use 


4.1 Compression set tests are intended to mea- 
sure the ability of rubber compounds to retain 
elastic properties after prolonged action of com- 
pressive stresses. The actual stressing service may 
involve the maintenance of a definite deflection, 
the constant application of a known force, or the 
rapidly repeated deformation and recovery re- 
sulting from intermittent compressive forces. 
Though the latter dynamic stressing, like the 
others, produces compression set, its effects as a 
whole are simulated more closely by compression 
flexing or hystersis tests. Therefore, compression 
set tests are considered to be mainly applicable 
to service conditions involving static stresses. 
Tests are frequently conducted at elevated tem- 
peratures. 


5. Test Specimens 

5.1 Specimens from each sample may be 
tested in duplicate (Option 1) or triplicate (Ор- 
tion 2). The compression set of the sample in 
Option І shall be the average of the two speci- 
mens, expressed as a percentage. The compres- 
sion set of the sample in Option 2 shall be the 
median (middle most value) of the three speci- 
mens expressed as a percentage. 

5.2 The standard test specimen shall be a cy- 
lindrical disk cut from a laboratory prepared slab. 

5.2.1 The dimensions of the standard speci- 
mens shall be: 


Type 14 2° 
Thickness, mm (їп.) 12.5 + 0.5 (0.49 6.0 + 0.2 (0.24 
+ 0.02) + 0.01) 
Diameter, mm (іп.) 29.0 + 0.5 (1.14 13.0 + 0.2 (0.51 
+ 0.02) + 0.01) 


^ Type І specimen is used in Methods А and В. 
в Type 2 specimen is used in Method В. 


5.2.2 When cutting the standard specimen, 
the circular die having the required inside dimen- 
sions specified in 5.2.1 shall be rotated in a drill 
press or similar device and lubricated by means 
of a soap solution. A minimum distance of 13 
mm (0.51 in.) shall be maintained between the 
cutting edge of the die and the edge of the slab. 
The cutting pressure shali be as light as possible 
to minimize cupping of the cut edges. The dies 
shall be maintained carefully so that the cutting 
edges are sharp and free of nicks. 
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5.3 An optional method of preparing the 
standard specimen may be the direct molding of 
a circular disk having the dimensions required 
for the method used and specified in 5.2.1. 

Note 2-4 should be recognized that ап equal time 
and temperature, if used for both the slab and molded 
specimen, will not produce an equivalent state of cure 
in the two types of specimen. A higher degree of cure 
will be obtained in the molded specimen. Adjustments, 
preferably in the time of cure, must be taken into 
consideration if comparisons between the specimens 
prepared by different methods are to be considered 
valid. 

Note 3—И is suggested, for the purpose of uniform- 
ity and closer tolerances in the molded specimen, that 
the dimensions of the mold be specified and shrinkage 
compensated for ‘therein. A two-plate mold with a 
cavity 13.0 + 0.1 mm (0.510 + 0.004 іп.) in thickness 
and 29.20 + 0.05 mm (1.148 + 0.002 in.) in diameter, 
with overflow grooves will provide Type 1 specimens 
for Method A and Method B. A similar mold but having 
acavity of 6.3 + 0.3 mm (0.25 + 0.012 in.) in thickness 
and [3.2 + 0.1 mm (0.52 + 0.004 in.) in diameter will 
provide Type 2 specimens for Method B. 


5.4 When the standard test specimen is to be 
replaced by a specimen taken from a vulcanized 
rubber part of greater thickness than the one 
indicated in 5.2.1, the sample thickness shall be 
reduced first by cutting transversely with a sharp 
knife and then followed by buffing to the required 
thickness in accordance with Practice D 3183. 

5.5 An alternative method of preparing spec- 
imens is by plying up cylindrical disks cut from 
a standard sheet prepared in accordance with 
Practice D 3182 using the specimen sizes speci- 
fied in 5.2.1 and cutting as described in 5.2.2. 

5.5.1 The disks shall be plied, without ce- 
menting, to the thickness required. Such plies 
shall be smooth, flat, of uniform thickness, and 
shall not exceed seven in number for Type | 
specimens and four in number for Type 2 speci- 
mens. 

5.5.2 Care shall be taken during handling and 
placing of the plied test specimen in the test 
fixture by keeping the circular faces parallel and 
at right angles to the axis of the cylinder. 

5.5.3 The results obtained on plied specimens 
may be different from those obtained using solid 
specimens and the results may be variable, par- 
ticularly if air is trapped between disks. 

5.5.4 The results obtained on the specimens 
prepared by one of the methods may be com- 
pared only to those prepared by the same 
method. 

5.6 For routine or product specification test- 
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ing, it is Sometimes more convenient to prepare 
specimens of a different size or shape, or both. 
When such specimens are used, the results should 
be compared only with those obtained from spec- 
imens of similar size and shape and not with 
those obtained with standard specimen. For such 
cases, the product specification should define the 
specimen as to the size and shape. If suitable 
specimens cannot be prepared from the product, 
the test method and allowable limits must be 
agreed upon between the producer and the pur- 
chaser. 


6. Conditioning 


6.1 Store all vulcanized test specimens or 
product samples to be tested at least 24 h but not 
more than 60 days. When the date of vulcaniza- 
tion is not known, make tests within 60 days 
after delivery by the producer of the article rep- 
resented by the specimen. 

6.2 Allow buffed specimens to rest at least 30 
min before specimens are cut for testing. 

6.3 Condition all specimens before testing for 
a minimum of 3 h at 23 + 2°C (73.4 + 3.6°F). 
Specimens whose compression set properties are 
affected by atmospheric moisture, shall be con- 
ditioned for a minimum of 24 h in an atmosphere 
controlled to 50 + 5 % relative humidity. 


METHOD A—COMPRESSION SET UNDER 
CONSTANT FORCE IN AIR 


7. Apparatus 

7.1 Dial Micrometer—A dial micrometer, for 
measuring specimen thickness, in accordance 
with Practice 3767, Method А1. 

7.2 Compression Device, consisting of a force 
application spring and two parallel compression 
plates assembled by means of a frame or threaded 
bolt in such a manner that the device shall be 
portable and self-contained after the force has 
been applied and that the parallelism of the plates 
shall be maintained. The force may be applied in 
accordance with either 7.2.1 or 7.2.2. 

7.2.1 Calibrated Spring Force Application— 
The required force shall be applied by a screw 
mechanism for compressing a calibrated spring 
the proper amount. The spring shall be of 
properly heat-treated spring steel with ends 
ground and perpendicular to the longitudinal 
axis of the spring. A suitable compression device 
is shown in Fig. 1. The spring shall conform to 
the following requirements: 
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7.2.1.1 The spring shall be calibrated at room 
temperature 23 + 5°C (73.4 + 9°F) by applying 
successive increments of force not exceeding 250 
М (50 Ibf) and measuring the corresponding de- 
flection to the nearest 0.2 mm (0.01 in.). The 
curve obtained by plotting the forces against the 
corresponding deflections shall have a slope of 
70 + 3.5 kN/m (400 + 20 Ibf/in.) at 1.8 kN (400 
lbf). The slope is obtained by dividing the two 
forces above and below 1.8 КМ by the difference 
between the corresponding deflections. 

7.2.1.2 {Тһе original dimensions of the spring 
shall not change due to fatigue by more than 0.3 
mm (0.01 in.) after it has been mounted in the 
compression device, compressed under a force of 
1.8 kN (400 Ibf), and heated in the oven for one 
week at 70°С x 2*C (158 + 3.6°F). In ordinary 
use, a weekly check of the dimensions shall show 
no greater change than this over a period of | 
year. 

7.2.1.3 The minimum force required to close 
the spring (solid) shall be 2.4 kN (530 Ibf). 

7.2.0 External Force Application—The ге- 
quired force shall be applied to the compression 
plates and spring by external means after the test 
specimen is mounted in the apparatus. Either a 
calibrated compression machine or known 
masses may be used for force application. Pro- 
vision shall be made by the use of bolts and nuts 
or other devices to prevent the specimen and 
spring from losing their initial deflections when 
the external force is removed. The spring shall 
have essentially the same characteristics as de- 
scribed in 7.2.1, but calibration is not required. 
A suitable compression device is shown in Fig. 
2: 

7.3 Plates—The plates between which the test 
specimen is compressed shall be made of steel of 
sufficient thickness to withstand the compressive 
stresses without bending. The surfaces against 
which the specimen is held shall have a highly 
polished chromium-plated finish and shall be 
cleaned thoroughly and wiped dry before each 
test. 

7.4 Oven, conforming to the specification for 
a Type ПВ laboratory oven given in Specification 
E 145. 


8. Procedure 

8.1 Original Thickness Measurement—Mea- 
sure the original thickness of the specimen to the 
nearest 0.02 mm (0.001 in.). Place the specimen 
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оп the anvil of the dial micrometer so that the 
presser foot will indicate the thickness at the 
central portion of the top and bottom faces. 

8.2 Application of Compressive Force—As- 
semble the specimens in the compression device, 
using extreme care to place them exactly in the 
center between the plates to avoid tilting. If the 
calibrated spring device (Fig. 1) is used, apply the 
compressive force by tightening the screw until 
the deflection as read from the scale is equivalent 
to that shown on the calibration curve for the 
spring corresponding to a force of [.8 kN (400 
ІМ). With the external loading device (Fig. 2), 
apply this force to the asembly in the compres- 
sion machine or by adding required masses, but 
in the latter case, take care to add the mass 
gradually without shock. Tighten the nuts and 
bolts just sufficiently to hold the initial deflec- 
tions of the specimen and spring. It is imperative 
that no additional force be applied in tightening 
the bolts. | 

8.3 Test Time and Test Temperature— 
Choose a suitable temperature and time for the 
compression set, depending upon the conditions 
of the expected service. In comparative tests, use 
identical temperature and heating periods. It is 
suggested that the test temperature be chosen 
from those listed in Practice D 1349. Suggested 
test periods are 22 h and 70 h. The specimen 
shall be at room temperature when inserted in 
the compression device. Place the assembled 
compression device in the oven within 2 h after 
completion of the assembly and allow it to re- 
main there for the required test period in dry air 
at the test temperature selected. At the end of the 
test period, take the device from the oven and 
remove the specimens immediately and allow it 
to cool. 

8.4 Cooling Period—While cooling, allow the 
specimens to rest on a poor thermally conducting 
surface, such as wood, for 30 min before making 
the measurement of the final thickness. Conduct 
the cooling period at a standard laboratory tem- 
perature of 23 + 2°C (73.4 + 3.6°F). Specimens 
whose compression set property is affected by 
atmospheric moisture shall be cooled in an at- 
mosphere controlled to 50 + 5 % relative humid- 
ity. 
8.5 Final Thickness Measurement—After the 
test period, measure the final thickness at the 
center of the specimen in accordance with 8.1. 


9. Calculation 


9.1 Calculate the compression set as a per- 
centage of the original thickness as follows: 


Ca = [(lo — 1/1] х 100 0) 
where: 
СА = compression set (Method А) as a percent- 
age of the original thickness, 
Іс = original thickness (8.1), and 
ћ = final thickness (8.5). 
10. Report 


10.1 The report shall include the following: 

10.1.1 Original dimensions of the test speci- 
men, including the original thickness, o, 

10.1.2 Actual compressive force on the speci- 
men as determined from the calibration curve of 
the spring and spring deflection reading (7.2.1) 
or as applied by an external force (7.2.2), 

10.1.3 Thickness of the test specimen 30 min 
after removal from the clamp, &, 

10.1.4 Type of test specimen used, together 
with the time and temperature of test, 

10.1.5 Compression set, expressed as a per- 
centage of the original thickness, 

10.1.6 Method used (Method A), and 

10.1.7 Number of specimens tested. 


METHOD B—COMPRESSION SET UNDER 
CONSTANT DEFLECTION IN AIR 


11. Apparatus 


11.1 Dial Micrometer—-A dial micrometer, 
for measuring the specimen thickness, in accord- 
ance with Practice D 3767, Method АІ. 

Note 4—For vulcanizates having a hardness below 
35 IRHD, the force on the presser foot should be 
reduced to 0.2 + 0.05 М (0.04 + 0.01 Ibf). 


11.2 Spacer Bars, to maintain the constant 
deflection required under Method B. 

11.2.1 Spacer bars for Type 1 samples shall 
have a thickness of 9.5 + 0.02 mm (0.375 + 
0.001 in.). 

11.2.2 Spacer bars for Type 2 samples shall 
have a thickness of 4.50 + 0.01 mm (0.1770 + 
0.0005 in.). 

11.3 Compression Device, consisting of two or 
more flat steel plates between the parallel faces 
of which the specimens may be compressed as 
shown in Fig. 3. Steel spacers for the required 
percentage of compression given in 12.2 shall be 
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placed on each side of the rubber specimens to 
control their thickness while compressed. The 
steel surfaces contacting the rubber specimens 
shall be ground to a maximum roughness of 250 
um (10 шп.) and then chromium plated and 
polished. 

11.4 Oven, conforming to the specification for 
a Type ПВ laboratory oven given in Specification 
E 14$. 

11.5 Plates—The plates between which the 
test specimen is compressed shall be made of 
steel of sufficient thickness to withstand the com- 
pressive stresses without bending. The surfaces 
against which the specimen is held shall have a 
highly polished chromium-plated finish and shall 
be cleaned thoroughly and wiped dry before each 
test. 


12. Procedure 


12.1 Original Thickness  Measurement— 
Measure the original thickness of the specimen 
to the nearest 0.02 mm (0.001 in.). Place the 
specimen on the anvil of the dial micrometer so 
that the presser foot will indicate the thickness at 
the central portion of the top and bottom faces. 

12.2 Application of Compressive Force— Place 
the test specimen between the plates of the com- 
pression device with the spacers on each side, 
allowing sufficient clearance for the bulging of 
the rubber when compressed (Fig. 3). Where a 
lubricant is applied, it shall consist of a thin 
coating of a lubricant having substantially no 
action on the rubber. For most purposes, a silicon 
or fluorosilicon fluid is suitable. Tighten the bolts 
so that the plates are drawn together uniformly 
until they are in contact with the spacers. The 
amount of compression employed shall be ap- 
proximately 25 %. A suitable mechanical or hy- 
draulic device may be used to facilitate assem- 
bling and disassembling the test fixture. 

12.3 Test Time and Temperature—Choose a 
suitable temperature and time for the compres- 
sion set, depending upon the conditions of the 
expected service. In comparative tests, use iden- 
tical temperature and test periods. It is suggested 
that the test temperature be chosen from those 
listed in Recommended Practice D 1349. Sug- 
gested test periods are 22 h and 70 h. The test 
specimen shall be at room temperature when 
inserted in the compression device. Place the 
assembled compression device in the oven within 


2 h after completion of the assembly and allow 
it to remain there for the required test period in 
dry air at the test temperature selected. At the 
end of the test period, take the device from the 
oven and remove the test specimen immediately 
and allow them to cool. 

12.4 Cooling Period—While cooling, allow 
the test specimen to rest on a poor thermally 
conducting surface, such as wood, for 30 min 
before making the measurement of the final 
thickness. Maintain the conditions during the 
cooling period in accordance with 8.4. 

12.5 Final Thickness Measurement—After 
the rest period, measure the final thickness at the 
center of the test specimen in accordance with 
12.1. 


13. Calculation 


13.1 Calculate the compression set expressed 
as a percentage of the original deflection as fol- 
lows: 


Св = Шо — tito — £)] х 100 (2) 


where: 

Св = compression set (Method B) expressed as 
percentage of the original deflection, 
original thickness of specimen (12.1), 
final thickness of specimen (12.5), and 

— fhickness of the spacer bar used. 
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Note 5—Lubrication of the operating surfaces of 
the compression device is optional while giving more 
reproducible results, lubrication may somewhat alter 
the compression set values. 


14. Report 


14.1 The report shall include the following: 

14.1.1 Original dimensions of the test speci- 
men including the original thickness, to, 

14.1.2 Percentage compression of the speci- 
men actually employed, 

14.1.3 Thickness of the test specimen 30 min 
after removal from the clamp, 1i, 

14.1.4 Type of test specimen used, together 
with the time and temperature of test, 

14.1.5 Whether or not the surfaces of the com- 
pression device are lubricated. If they are, what 
type lubrication was used, 

14.1.6 Compression set, expressed as a per- 
centage of the original deflection, 

14.1.7 Method used (Method B), and 
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14.1.8 Мапим. — сресипеп5 tested. 
15. Precision? and B.. 


15.1 These precision ..atements have been 
prepared in accordance with Practice D 3040-81. 
Please refer to this practice for terminology and 
other testing and statistical concepts. 

15.2 Prepared test specimens of two rubbers, 
Methods A and B, were supplied to five labora- 
tories. These were tested in duplicate each day 
on two separate testing days. A test result, there- 
fore, is the average of two test specimens, for 
both Methods A and B. 

15.3 One laboratory did not run the Method 


A testing, therefore the precision for Method A 
is derived from four laboratories. 

15.4 The precision results are given in Tables 
І and 2. 

15.5 Bias—|n test method statistical termi- 
nology, bias is the difference between an average 
test value and the reference or true test property 
value. Reference values do not exist for this test 
method since the value or level of the test prop- 
erty is exclusively defined by the test method. 
Bias, therefore, cannot be determined. 


5 Supporting data are available from ASTM Headquarters. 
Request RR: D-11-1138. 


TABLE 1 1.ОС Precision Data Compression Set —Method А 
Within Laboratories Among Laboratories 
Material Mean Level — 
5 CV 5 СЕ 
а 1.73 (%) 0.0500 0.0277 0.190 0.1096 
В 26.1 0.898 0.0336 2.37 0.0908 
Average ог Pooled 0.636 0.0308 1.681 0.1006 
Values 
Repeatability Reproducibility 
Standard Deviation, (5)! 0.636 1.743 
Coefficient or Variation, (СИ) 0.0308 0.103 
Least Significant Difference, (.SD)^€ 8.8% 29.) 96 


^ An average value, the value of S varies with mean level. 


8 LSD based on 95 % confidence level; two results are considered significantly different if their difference, expressed as a 


percentage of their average, exceeds the stated percent value. 


€ The LSD values are relative percent, that is, a percent of the ^percent" values used to measure the tested property. 


TABLE 2 БОС Precision Data Compression Set —Method В 


Within Laboratories Among Laboratories 
Material Mean Level a ME a E 
$ CV 5 CV 
A 13.7 (96) 0.591 0.0420 1.543 0.113 
B 52.8 0.567 0.0110 5.924 0.112 
Average or Pooled 0.579 0.0307 4.329 0.1124 
Values 
Repeatability Reproducibility 
Standard Deviation, (S)4 0.579 4.348 
Coefficient or Variation, (CV) 0.0307 0.114 
Least Significant Difference, (LSD)? 8.7% 32.4% 


4 An average value, the value of S varies with mean level. 


2150 based on 95 % confidence level; two results are considered significantly different if their difference, expressed as а 


percentage of their average, exceeds the stated percent value. 


€ The LSD values are relative percent, that is, a percent of the “percent” values used to measure the tested property. 


iw 


FIG. 1 Device for Compression Set Test, Using | | FIG. 2 Device for Compression Set Test, Us 
Calibrated Spring Loading, Method A External Loading, Method A - 


FIG. 3 Device for Compression Set Test Under 
Constant Deflection, Method B 


The American Society for Testing and Materials takes no position respecting the validity of any patent rights asserted in connection 
with any item mentioned in this standard. Users of this standard are expressly advised that determination of the validity of any such 
patent rights, and the risk of infringement of such rights, are entirely their own responsibility. 


This standard is subject to revision at any time by the responsible technical committee and must be reviewed every five years and 
if not revised, either reapproved or withdrawn. Your comments are invited either for revision of this standard or for additional 
standards and should be addressed to ASTM Headquarters. Your comments will receive careful consideration at a meeting of the 
responsible technical committee, which you may attend. If you feel that your comments have not received a fair hearing you should 
make your views known to the ASTM Committee on Standards, 1916 Race St., Philadelphia, Pa. 19103. 
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NASA 
Natonal Aeronaviica and 
Space Administration 
Washington, О.С. 
е9 JL 17 95 


10: M/Associate Administrator for Space Flight 
FROM: MPS/Irv Davids 


SUBJECT: Сазе to Case and Nozzle to Case "0" Ring Seal Erosion 
Probleas 


As а result of the probless being incurred during fiight on both 
сазе to case and nozzle to case "O" ring erosion, Mr. Hamby and І 
visited МЗРС on July 11, 1985, to discuss this issue with both 
project and S&B personnel. Following are some important factors 
Concerming these problema: 


А.  Nozsle to Case "0" ring erosios 


There have been twelve (12) instances during flight where there 
have been sone prisary "0" ring erosion. In one specific case 
there was 8150 erosion of the secondary "0" ring seal. There 
were two (2) різну "0" ring seals that were heat affected (no 
2502406) and two (2) cases in which soot blew by the primary 
seals. 


The prise suspect as the cause for the erosion on the primary "О" 
ring seals is the type of putty used. It is Thickol’s position 
that during assembly, leak check, or ignition, е hole can be 
formed Маје м the putty which initiates "О" ring erosion due to 
e jetting effect. It із important to note that after STS-10, the 
mahufacturer of the putty vent out of business and e new putty 
manufacturer was contracted. The new putty is believed to be 
тога susceptible to environmental effects such as soisture which 
makos the putty more tacky. 


There sre various options being considered such as removal of 
putty, varying the putty configuration to prevent the jetting 
effect, use of е putty ваде by a Canadian Manufacturer which 
includes asbestos, and various combination of putty end grease. 
рит analysis and/or tests ere underway to assess these 
options. 


Thiokol 16 seriously considering the deletion of putty on the Qi- 

$ nozzie/case joint since they believe the putty з the prise 

cause of the erosion. А decision on this change is planned to be 

wade this week. 1 have reservations about doing it, considering 

iM Eanes of the ФІ-5 firing in qualifying the РЫС for 
ght. 
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It is important to aote that the cause and effect of the putt 
varies. There are some MSFC personnel who sre not convinced that 
the holes in the putty are the source of the problem but feel 
that it say be в reverse effect in that the hot gases may be 
leaking through the seal and causing the hole track in the putty. 


Considering the fact that there doesn't appear to be а validateó 
resolution as to the effect of putty, 1 would certainly question 
the wisdom in removing іс on (M-5. 


B. Case to Case "0" Ring Erosion 


There have been five (5) occurrences during flight where there 
was primary field joint "О" ring erosion. There was one case 
where the secondary "O" ring was heat sffected with no erosion. 
The erosion with the field joint primary "О" rings is considered 
by some to be more critical than the nozzle joint due to the fact 
that during the pressure build up on the primary "O" ring the 
unpressurized 11014 joint secondary seal unsests cue to joint 
rotation. 
The problem with the unseating of the secondary "О" ring during 
joint rotation has been known for quite some time. In order to 
eliminate this problem on the РИС field joints е capture feature 
was designed which prevents the secondary seal from lifting 
off. During our discussions on this issue with MSFC, an action 
was assigned for them to identify the timing associated with the 
unseating of the secondary "О" ring and the seating of the 
primary "0" ring during rotation. How long it takes the 
secondary "0" ring to lift off during rotation and when in the 
ressure cycle it lifts ere key factors in the determination of 
ts criticality. 


The present consensus is that if the pur "о" ring seats 
а ignition, and subsequently fails, the unseated secondary 
0" ring will not serve its intended purpose as a redundsnt 
8681. However, redundancy does exist during the ignition cycle, 
which i3 the nost critical time. 


It is recommended that we arrange for NSFC to provide an overall 
briefing to you on the SRM "0" rings, including failure history, 
Current status, and options for correcting the problens. 


“с>. 
Irving Davids 


се: 
М/Мг. Weeks 


ML/Mr. Karrin ton 
МР/Мт. Winterhalter 


64-420 0 - 86 - 13 
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VII-C 
Nations! Aeronautica and 
George C. Marshall Space Fight Center 44 
Marshat Space Flight Center, Alabama | 190: 
35812 
5 
wame — 5442-349-85 
то: MASA Headquarters | 
Attn: Со ил. 8. Бању , у = 
ҮВОМ: ЕА41/1.. в. -Ии0210у | 


БОВЈЕСТ: SRN Joint/O-Ring Erosion 


„On July 31, 1985 you and Irv Davids were briefed hy Jim Thomas 
.ef | ottica ов the history and the effort unde: a to resolve 

the íssües and concerns of the above subject. Багар this ( 
. briefing the following information мав requested: 


1. Оцедідоді If the field joint secondary seal lifts off 
tbe metal mating surfaces during motor pressurization, 
how soon vill ít return to а positon where contact is 
re-established? 


Anayver; Bench test data indicates that the o-ring 
resiliency (ісі capability to follow the setal) isa 
function of temperature and rate of case е піст 
ИТІ measured the.force of the o-ring against. | | 
 pláttens, which simulated the nominal —— са Ме. . 
225124 дай approximated the case expansion бізсардр 

с 5 um ра мг 2... Ы 


At 1000Р tbe o-ring maintained contact. At 7 

the o-ring lost contact for 2.4 seconds, . — | 
the o-ring did not re-establish contact ја teg siastes 
at Which time the test vas terminated. "| Mesa 


The conclusion is that secondary | capability ia 
the SRM field joint cannot be guaranteed. 


2. Question: If the primary o-ring does not seal, vill 
the secondary seal seat sufficient time to preveat 
joint leakage? 


Anawers ИТІ has no reason to suspect that the primery 
seal would evet fail after pressure equilibrium 18 
reached, i.e., after the ignition transient. If the 


| 
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primary o-ring vere to fail from 0 to 170 milli- 
seconds, there is a vory rre probability that the 
secondary o-ring would hold pressure since tbe case 
bas not expanded appreciably at this point. If the 
primary seal were to fail from 170 to 330 ailli- 
seconds, the probability of the secondary seal holding 
is reduced. From 330 to 600 milliseconds the chance 
of the secondary seal bolding is small. This isa 
direct result of the o-ring's slow response compared 
to the веса] -case segments as the joint rotates. 


2% Question: Headquarters was not aware that the 
secondary o-ring may not seat due to joint rotation, (| 
when was this incorporated into the FMEA/CIL? 

Answer: ИТІ submitted TwR-13520 "Retention Rationale, 

SRM Simplex Seal" to MSPC on 12/1/82. The CIL 

соса оно change was approved by Level III CCB on 

1/21/83. Level II authorized submittal of Level I 

change request #221061, on 3/2/83. On 5/2/83 Level II 

issued PRCBD 522106LRl to lement approved Level I 


~ 
- .- . 


change request 1221061, and Ш22106И. 
> ее ---- Aera 
L. В. Mulloy ^ Е rU Uo: de 
Manager, SBB Project - 1 5 .. 
М Cat tow бе ПОТ с 
а... гэн ante es 


— . 
— — c 


.. CC: а; й `$ 
SA41/Messrs. Месії, 
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NASA $1О.РО._ 710.5А 


бросе САТЕ. _#7257/812___. 
flight 
Ты ЕЕРЕСТ FoR 
575 51-4. 


. . РВОСВАМ DIRECTIVE 


Responsible Offices Б7/ Бресе Buttle Operations, Integration Division 
ERIT: Space Shuttle Flight Readiness Revins 


1. кле 


This Directive defines the геехувірі)ісіве. гр: гаганта, ad реосеботеє 
tc insure effective planning for алй condact of Flight Readiness Reviews 
бос the Врасе Tranmpoctatiur Bystes (525. а: зго. 


“із Directive із applicable te al] 527 касте. 
3. Су 


It is tne policy of the Asacciate Мула rator for Space Flight (АБР 
to make ar aesesument of 86:68:08 readiness peior to васт. 712655. This 
will ім eccomplianed by е consslideted Flog. Рила Review (PRR?) Of 
ell activities/eierents бөсекзагу for safe ал! вгзсеваіш conduct of the 
launch, flight, anf post-lakting operations. The review wii) be supported 
by the MASA Chief Engineer але the Garter багестогь tran JIL, МЕРС. and 
кас. 


Те РЎ vill be preceded by detailed readiness reviews (pre-FRF's) on 
imfividuel elements, inciting cargo, under the cognisance of the 
reeponaiole Managers. 


4. RESPOSTBILITIES, 
а. Фи ємдосо of the РИЙ із t^e reaponaibílity of the АА-б? ог his 
Фегсітғесей representetive. 


b. The Director, Space Shuttie Operetione, is responsible for FRR 
Pami anf requirements, coordinating the РАЙ egends, ГО ection 
items and action item closeouts. аге prepering the readiness 
XXXC 


с. The JEC Level 11 National Space Trewportstiar Systems (NETE) Program 
Manager is reeponsibie for i emmting readiness review plans and 
requirwnents, oryenizing the FRR, ané for the program assesment of 
flight reediness. 


€. те PUU KIN Fnepete бізі (GUnaugct pre-FRR'& UD Owvélop сег 
readiness aseeseen ard ere responsible for the РИ» briefing content 


СО” B 54 
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in Чат particular ares. 


$. АТУЫ АБУЛАРОФСЯ 


b. 


е. 


Му] ": The FRR will ا‎ а delta review concest fron prior 
reviews (eg. асса, Obiter out/Prt-ftsck, Cargo Reed iness) 


ағд previous 876 missions. The review vil] be cor$ucted by te) econ: 
using the MASA Teleconferenoe Network. 


Schedule: Те ГАК will bs МИМ between ore av бю weeks prior to 
Tanck. 


Agenda: The mejor эрелда itas and responsibilities ares 

(1) Introduction Мегдїагтага/1»-6? 

(2) Integreted Byster ------ JIC Manager, "77$ Program 

(3) Orbitet/Crev СРЕ ————— JS9-/"anajer, Space Shuttle Projects 
(4) SOE EPC Manager, Space Buttle Projects 
(5) Cargo ӘК /fanager, Mission integration 


(6) Launch è Landing ————— KK Лигостог, Htwttle Projects 
Operetions ا‎ ~ 


(7) Flight Operations ————— 28ЛХгєссос, Mission Operstions 


(8) Gafety, Peliability а ——— ЖИ с СА Manager, Әресе бле 
Quality Assurance 27 


(9) Action Items /Aeadiness ——- Bee^goaccere АБР 
Poll 


Presentation тма із: The peesencstion of agenda itens мії) normaly 
include ә Всієї status summery with appropriate supporting detail on 
&:gnificant itens mé conclud« with а reetiness assessment. The 
peesertation topics and scope КАДА be беуеісрей from the pre-PR's 


and кодів: Е 
(1) be thet required to provide the AA-EP with the information needed > 
to maks а judgment эл te flight горб 180) u 


(2) review recent significant геесічаё problems and prior flight ёй 
огсжај Les when necessary Xo євіль) іс, confidence; e 


(3) асмет all үксі еме срее item, and coretraints ТЄВөь.г s9 to Бе 
resolved befocw the віта; 


(4) establish the mission гола: ге сс”? ішыгесіст іл teres of all 
significant changes since the 1431 #75 mission (changes to be 


considered include hardware. acftears, vehicle 
GPTV iS NOON, Jame «қынаға 08114618, Fisgnt pane. 


МЕЕ 


?. 
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‘BE 12:12 NASA мс WASH. L.C. — 


flight rules, and crew рсосеб лее)! 


Within the above guidalines, the scope of the review should cover 
status and issues in areas much as: vehicle checkout, shortages ond 
орып work, unexpleined anaealies, haróesre failures, prior flight 
anomalies, certification/verificstion, as-built hardware configuration 
versus certified hardware list, Critical Item Gist (CIL), deve nt, 
qualification, and reliability testing, walvers and devistions, 
limited life components, leunch critical spares, Sneak circuits, 
тувсер safety/nszards, and flight margins. In addition, the review 
should also cover readiness of ground gystexs/facílities (6.0., launch 
віза, landing sites, network, Mission Control Center), operations 
tema (2... lanch, recovery, flight crew, flight control), and 
support operations (e.g., ШОО, contingency, weather, matical, 
security). 


ГОДУ ТАШЫЛ: КЕЗЛИСРИЋ 


ь. 


с. 


b. 


Presentations: Vugraphs vill be usod for PRR presentations, anc а 

Бараг сору will pe provided to the reviewing officials. A copy of tre 

presentation meteria) shall be provided to talecan locations 24 hours 
іл әдлесе of the review. 


Certificate of 711 Readiness (СОРУ)! СОРА егдосевтепса, including 
а complete listing котрељоле, Vill be executed and submitted at 


the conclusion of the review (Reference: Әресе Shttie Progra 
Procedure for Certification of Flight Readiness (OR), JSC 08117, 


current revision). 


Т o kesertament:i А УЯХ assesaent, letter will be issued by ОБР within 
two working days after the review and wil] include the following: 


(I Ac*ior. items; 
(3) Significant бесівіспа; 
{3} ONM exceptions av endorpessnt summary. 


FRA ACTION ГТЕМУОРОМ ITE CLOSEOUT REPORTING REQUIRDENTS 


Status: ‘The WETS Ргодтае Manager will report periodically оп the 
ciosan status of action items горап items identified at the РКА. 
This ашу be accomplished by the Daily Special Level 11 PAD. 


Significant itane occurring 9u5eeqQoent to the FRR will also be 
reported to tne AÀ-GP. Actions thet cen be easily acconpi iw M 


‘without safety, mission. ск launch impact and до ret violate flight 


vehicle ег launch complex eonfigurstion integrity сє cause basic 
changes to Jeunch cxwit criteria, 222 rules, flight ріал, or abort 
onê alternate pission plans, need not be reported. 


Actior Iter Ciceeouts: Closeouts to FRR action itens vill. be 
жатып Са АК шу аум: 111/11 іп writing ОТ зид агу wll) 


State fully the basis for clamean, that is: action taken, resJits 


жанын QD MEE у; 
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eco BE жесе NESE hG се 


абба, ant devecninations веде. М action wili mot bs clored ota! 
бота” 18 corgleted b» thw ЛА-ЕҒ or hie без раке! repressntecive. 


Sere Bvoestioma: The reeniution of all excep forme í*entífiad in the 
CEFR еөздсексчелі wil) be complete? Uy two Árna prior te aret, ви а 
оору of the endures: will be елите! to the tirectoc, Soste 


Блоге Operations. 


PRYXEOTUS 


а. imie Points ой Стат! РАЯ у} lemming ax! procedures will be 
осот: таю through віт ie points af contact established at the 
fallain, locaticost: 


Но.в3цовгієть - Брасе Борје Operationa, Integration. Division 


cst = Level І; NS Program Of floe 
SPC - Boece Shuttle Projects Of fice 
қы = Рресе Shuttle Projects Management Directorate 


Individuals will be decignsted by the responsible organizstions and 
the names provided to tne Director, Space Suttle Operations, Duties 
will be defined by separate correspondence 18508) by the Director, 
Space Buttle Operations. 


Ы, QOuidelines: Approximately three weeks prior to the PRR, guidelines 
vili be issued by the Director, Басе Knottle Operations, establishing 
the review date and any special requirements not covered by this 


Girective, 


с, FPR Qena: Proposed agenda itema/tíimes vill be submitted to 
Level Т, by the single points 01 contact at the respective Centers 
two weeks үсік to the FRR. Pespowible Space Shuttle Operations 
Фігесіогь will coordinate detailed presentation items with their 
Project ағд мії) әссері item Grtermine’d to be completed and not 


requiring the АА-8Р review at the FRR. The final FRR agenda will be 
coordinsted by tha Director, Space Shuttie Operations, art issued 
about one week prior to the PRR. 


ACTION 

This Directive muperaedes ЕТЬ-РО 710.5 dated Мау 13, 1981, and shall be 
imp.euwnted by the JECTS Program Manager effective ETSY алі subsequent 
niesiona, 


weal haeke 
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Organizational NASA 


Issuance 


George C. Marshall Space Fight Center 
Marshal Soace Flight Center, Alabama 35812 


Базе (базе, мото 


Огөгөмэцөм 


Shuttle Projects Office 


Subject: SHUTTLE PROJECT FLIGHT READINESS REVIEW 


~ 1. PURPOSE 
go 


This procedure defines the responsibilities, requirements, and procedures to insure 
effective planning for and conduct of the Shuttle Proiects Flight Readiness Review. 


2. SCOPE 


This procedure is applicable to ali STS missions, 


3. POLICY 


Organizations which participate іп MSFC Shuttle Projects activities, 


b. The Shuttie Project FRR will be preceded by separate detailed readiness reviews 
(pre-FRR's) of individual elements by the prime contractor's and the element 


ресіесі offices, under the cognizance of the responsible Managers, 


& RESPONSIBILITIES 


&. The conduct of the Shuttle Proiects FRR 13 the responsibility of the Manager, 


Shuttle Projects or his designated representative. 


b. The Program Plans and Management Systems Office is responsible for FRR 
scheduling, planning and requirements, coordinating the FRR agenda, FRR action 
Items and action item closeouts, and preparing the readiness assessment and 
maintenance of ай records associated therewith. The Program Plans and 
Management Systems Office will be the focal point with the JSC Level lI 
Nationa! Space Tra" sportation System (NSTS) Program Manager and the Level | 


FRR under the cognizance cf me Director, Space Shuttle Operations. 


мг. E 
- чч * і 7. -»-- - 


E. ок 
MBPC . Porm IPIE (Rew Дру 1079). _-- 7227 эш. чел лз ат ат ти 
— — — = 


It is the policy of the Manager, Shuttle Projects to make an assessment of flight 
readiness of the Shuttle projects prior to each flight. This will be accomplished 
by a consolidated Flight Readiness Review (FRR) of al! MSFC Shuttle Projects 
Office elements necessary for safe and successful conduct of the launch, flight, 
and post-landing operations The review will be supported by all MSFC 


1--....., 


У on РА ў | Pi 
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737 


388 


SOP $000.1 
€. The Project Managers will assure the effectivity of а detailed рате contractor 
pre-FRR, 


d. The Project Managers will conduct FRR's to develop their readiness assessment 
and are responsible for the Shuttle Projects FRR briefing content ја their 


particular area. 


5. PRIME CONTRACTOR FRE-FRR 


Project Manzgers will assure thet each prime contractor conducts а pre-FRP in 
preparation for the Project Offices FRR, The contractors review shall be chaired by & 
level of management at least one level above the contractor Project Manager. 


6. SHUTTLE ELEMENT FRR 
“а. The Project will conduct a FRR in preparation for the Shuttle Projects PRR. 
The respective Project Manager of element under review will serve as Chairman. 
The membership wil! consist of representatives from the following: 
Shuttle Pro‘ects Office 
S&E Directorate 


Reliability and Quality Assurance 


Safety 2 
Contractors | 
USBI, MMC, Thiokol, Rocketdyne 


b. Each Project Office wil! make the necessary conference arrangements, notify 
review members, designate secretary, prepare presentations, record and track 
action Items, closures and retain а copy of the presentation material in the 
Project Office record file. Му - 


7. SHUTTLE PROJECTS FRR REQUIRE MENTS 


a Review Concept: The Shuttle Prcjects FRR will employ а delta review concept v 
Гот prior reviews and previous STS missions. с 
> 
b. Schedule: The Shuttle Projects FRR will be held prior to the Center FRR. ~ 
- м 
с. Agenda: The major agenda items and responsibilities ares wn 
0) Introduction Programs Plans and Management 
Systems Office 
(2) Systems Manager, Systems Management Office 
(3) External Tank Manager, External Tank Project 727 


Office » 
и 


(9) 


б) 


(6) 
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Solid Rocket Booster Maneger, Solid Rocket Booster 
Project Office 
Flight Engine Manager, Flight Engine Project 
Office 
Action Items/Readiness Progr&m Plans and Manegement 
Poll Systems Office 


Presentation Emphasis: The presentation of agenda items will normally inciude а 
brief status summary with appropriate supporting сета on significant items and 
conclude with a readiness assessment. The presentation topics and scope shouid 
be developed from the Project FRR's and should: 


(1) 


(2) 


(3) 


(4) 


be that required to provide the Shuttie Projects Manager and Review Team 
with the information needed to make an independent judgement as to flight 
readiness; 


review recent significant ressived problems and prior flight anomalies 
when necessary to establish confidence; 


cover all problems, technical issues, open items, and constraints remaining 
to be resolved before t^e flight; 


establish the flight baseline configuration in terms of al! significant 
Changes since the last flight and/or applicable STS flight. 


Within the above guidelines, the scope of the review should cover status, changes 
and issues in areas such аз: 


(1) 


Hardware/Software Anomalies, Failures including development алд 
acceptance test failures 

Launch Commit Criteria 

Flight Plans/Rules 

Vehicle Checkout - 
Shortages and Opcn Work 

Prior Flight Anomalies 

As-built Hardware Configuration versus Certified Hardware List 

Critical Item List (CTLY/Hazards 

Developr ent, Qualification, and Reliability Testing 
(Certification/Verification) 

Waivers and Deviations 

Limited Life Components 

Launch Critical Spares 

Sneak Circuits 

Flight Margins 

PAS Assessment 

Safety 

Process Changes: Design, manufacturing, checkout and launch 
processing 
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Shuttle Proiects FRR Membership: The Manager, Shuttle Projects will establish 
review membership and serve аз Chairman, Membership will comprise 
representation from the following organizations: 


Program/Project Offices 

Science & Engineering Directorate 
Reliability & Quality Assurance 
Satety 


Contractors 
; MMC, Thiokol, Rocketdyne 


Documentation Requirements 


(1) Presentations: Vugraphs wil! be used for FRR presentations and paper 
Copies will be provided to the reviewing officials. 


(2) Statement of Flight Readiness Statement of Flight Readiness will be 
executed by ай Project Managers and submitted at the conclusion of the 
review. 


ERR Action Item/Open Item Closeout Reporting Requirements 


(1) Subsequent ю the conclusion of the Shuttle Projects FRR, a copy of 
assigned action Items will be provided to each actionee by the Program 
Plans and Management Systems Office. 


2) The FRR secretary wil! track al! action items and provide status to the 
Shuttle Projects Manager. 


(3) Closeouts to FRR action Items will be submitted to the Program Plans 
and Management Systems Office in writing and will state fully the basis 
for closeout, that ія action taken, results obtained, and determinations 
made. The Program Plans and Management Systems Office will submit 
closures to the Manager, Shuttle Projects or his designated 
representative for signature. 


Procedures 


(1) Single Points of Contact FRR planning and procedures will be 
coordinated through a single point of contact in the Program Plans and 
Management Svstems Office. 


Individual element for points of contact will be designated by the 
responsible Project Manager and the names provided to the Program 
Pians and Management Systems Office, These individuals will be 
responsible for these duties outlined in paragraph 6.b. 


188950 24 
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С) Guidelines: Approximately three weeks prior to the MSFC Shuttle Projects 
ge 


» guidelines wil! be prepared by Program Plans and Management 
the Manager, Shuttle Projects, establishing 


Systems Office and issued by 
Shuttle Projects FRR date, with applicable 


Projects FRR date, 
membership, and any special requirements not covered by this procedure, 


3. EFFECTIVE DATE 
This procedure is effective on date of Issue. 


Robert E. Lindstrom 
Manager, Shuttle Projects 


eeescc За 


ч 


ЗОР 2000,1 


са 

5А01/ Dr. і.әуіпрооб 
5А01/Мг. Askew 
5А04/ Mr. Harden 
5А11/Мг, Lombardo 
SA31/Mr. Bridwell 
5А41/Мг, Mulloy 
SA51/Mr. Taylor 
5А71/Мг. Boze 
5А41/Мг, Zoller 
ЕА01/Мг. Kingsbury 
ЕАО 1/Ог, Thomson 
ЕЕЙ!/Мг. Hardy 
ЕЕ} 1/Мг. Horton 

" EE21/Mr. Thomason 
EE31/Mr. Nichols 
EE51/Mr. Goetz 
EGO1/Mr. Brooks 
EGOX/Mr. Bunn 
ЕВ01/Мг. Bradford 


E HO1/Mr. Schwinghamer 


ESO1/Dr. Dessler 
ЕРО1/Мг, McCool 
ЕР&3/Мг. Worlund 
ELO 1/Mr. Hopson 


EDO01/Dr. McDonough 


ETO1/Mr. Taylor 
РОО!/ мг. Marshall 
ТА Мт. Odom 
NAO1/Mr. Thomas 
3A01/Mr. Downey 
DAO1/Dr. Lucas 
DDO1/Mr. Lee 
DEO1/Mr. Bethay 
око Мг. Sneed 
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Sp^ze Aamun:st-aton 


George С Marshal! Space Flight Centor 
Ma'sna: Space Front Center A apama 


358:2 
КД ~ ~ 
DAO? E 
TO: Distribution 
FROM: DAO1/W. В, Lucas 
SUBJECT: MSFC Flight Readiness Review (FRR) Board 


for MSFC Elements for Mission 51-L 


An MSFC FRR Board of senior MSFC management personnel will 
convene at B:30 а.к. on January 13, 1986, in Building 5663, 
HOSC/MCR, to review and assess the readiness status of the 
MSFC Mission 51-L elements for flight. 


This meeting will be held at the SECRET level and all 
documentation will be handled and presented іп accordance 
with the NASA Security regulations. Attendance will be 
restricted and all Prejects are to coordinate this activity 
through the Program Planning and Management Systems Office, 


Tow Staples, 32-0338. 


The Center Board is composed of the following: 


DAO1/W. R. Lucas: Chairman 
DD01/T. J. Lee Vice Chairman 
ЕАО1/5. E. Kingsbury 
DSO1/F. А. Speer 
EGO1/J. Р. Мадоје 
ў JAOt/I. А. Downey 
PAO1/W. К. Marshall 
CSO1/J. C. Walker 
2476/5. G. Herderson: Secretariat 


Each project manager must certify the flight readiness of 
his hardware enc present supporting rationale and data зо 
the Board can independently assess the flight readiness. 
The Shuttle Projects Office manager is responsible for 
preparation and coordination of the meeting, presenting an 
Overall assessment cf flight readíness, recording of minutes 
anc action items, and tracking action items for closure by 


tne Reviev Board. 


197 PERLE см 2- 9 
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Erphasis will be placed on safety of flight and mission 
success, including potential impact of prior flight 
anomelies; ground test anomalies; revisions to hardware, 
software, launch commit criteria, or redlines wh:ck have not 
been flight verified; revisions to SRM recovery risks since 
the previous flight; any waiver which has not been flight 


verified or which requires external approval; and any 
revisions to hezard er critical iter lists. 755065, 
concerns, and risks shoul’ be clearly identified es well as 


methods of closure, 


In sn effort to minimize sdmrnistrati+ve control requiren: 


nts 


ИХ 


associated with the dissemination of clessified data, an 


effort is to be made to present classified information 


only 


through viewgraphs. If Projects elect to incorporate 
classified date within their handouts, it is the Project's 


responsibility to assure that the handouts are marked 


and 


handled in accordance with the NASA Security regulations. 
If any assistance is needed in this matter, please contact 


the MSFC Security Division at 3-423210. 


A preliminary agenda is enclosed. 


—— LL 
ТЕМЕ. Lucas 
Director 


Enclosure 


Distribution: 
See Page 3 
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SUBJECT: Assi igning Launch Constraints on Open Problecs 
Submitted to МЕРС FAS - 2 


The Shuttle Projects Office has established a requirement 
Жос identification of launch constraints for problems being 
reported to the MSFC Problex Assessment System (PAS) by 


element contractors, ` Each element сспсгасссг (Rocketdyne, 


MMC, USBI, and Thibkol) kas been directed to support this 
requirement by provicing launch constraint information on 
each new problem submitted to the MSFC РАЗ. The launch 
constraint 102огшас1сс provided by the contractor is 

based upon their preliminary technical evaluation ang will 
require final concurrence by the responsible element project 


manager. 


&. Tre folloving guidelines have beer established to aic 
in making constraint decisions on open problems and are limited 
nation only. Іп accordance with 


to recurrence control ceterminati 

practices established on past programs, remedial actions (e.g. 
removal anc replacement of defective hardware, etc.). Ғос cor- 
recting ciscrepancies on the vehicle to be launched are con- 
5ідегес launch constraints and are tracked by the KSC system. 


. (1) A11 open problems coded criticality 1, ЈЕ, 2, or 
28 will be considered launch constraints until resolved 
— control establishec and its implementation 
effectivity determined) or о. rationale, i.e., 
ižferent configuraclon, etc., ists’ to conclude that this 
problem will пог occur on the f light vehicle during prelaunch, 


launch, or f*iign-. 


(2) Problems coded criticality 3 will not be соп- у 
i uniess (a) the potential exists ої 


sidered launch conscrainzrs 
leading to а сгісісаііту 1 or 2 failure mode; or (b) the 
failed component has multiple use on the element anc more 

than one occurrence could іеаё го а eriticaliry 2 condition; 

от (c) the failure covid result in multiple loss of flight 
instrumentation channels. 12 а cr “сеу 3 is десегпїпед 

со be a launch constraint, it will be treated the same as а. (1) 


above. 
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гэ 


Ь. То assure that each reported problem is reviewed 
for correct criticality and constraint assignment by the 
appropriate MSFC personnel, the following procedure will be 
followed: 

(1) The responsible S& design actionee anc the 
element project office actionee will review each problem 
upcz receipt to assure that the criticality and constraint . 
assigmments meet with their approval. Exceptions to ; e 
eriticality or constraint assignzent will be coordinated 
sith the Froblem Assessment Center (РАС) actionee withi 
two working cays from receipt of che problem report. 

| (2) The Problem Assessment Center will prepare а 
weekly constraints list by elemenz. This list will be 


сршістеф to the Shuttle КАЧА Support Office, EGO3, for 
input to the Shuttle Projects Manager, SAO]. Copies of 
the constraint list will be furnished conctirrently to each 


Shuttle Elemen= Project Manager. 


- (3) Launch constraints will be reviewed at each 
Problem Review Board (РКВ) meeting. 
The Problem Assessment Center will be responsible for 
ceercinating ail launch constraint activity and assuring 
that information is ргогегіу documented in the Problem 
Assessment Svstem (PAS) сата bese and transzitted to MS 


- 


~ 
- 
- 


~ 
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гагаретегт 


Robert E. Lindstrom 
Manager 
Shuttle Projects Office 
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See page 3 
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